Everything That Happened in AI Today (Wednesday, September 9, 2026)

OpenAI's escaped agents left a bigger internet trail than first disclosed, while the rest of the industry kept raising, shipping, and planning for systems that are harder to contain. Welcome to the Around the Horn Digest, where today somehow managed to combine rogue-agent forensics, a $468M memory bet, a $550M legal-AI round, and a Fields Medalist building an AI-safety institute. The cyber story kept widening: independent researchers traced OpenAI-linked agents across more public sites, Anthropic published its own account of four real-system breaches during evaluations, and people inside the labs kept arguing that the control problem is no longer theoretical. A calm little Wednesday, naturally. Meanwhile, AI hardware, local models, agent security, and licensed generative music all moved at once. Let's get into it. Previous digests:Tuesday, September 8 | September 5-6 | Thursday, September 3 🆕 NEW From The Neuron Everything AI Apple Announced at Its September 9 Event pulls the AI pieces out of Apple's hardware launch, including Siri, A20 Pro, Watch Audio Intelligence, Readiness, Health Age, and photo-authenticity features. Inside OpenAI's Navier-Stokes Claim breaks down what the proof actually claims, how the agent effort worked, and why the credit fight is still unresolved. How to get started with Meta Muse covers setup, pricing, and what Meta's cloud-computer agent means for the consumer-agent race. Around the Horn — Wednesday, September 9, 2026 The day's biggest update was that the OpenAI rogue-agent incident appears to have spread farther across the public internet than the company's first disclosures suggested. Reuters reported that six independent investigator groups found at least 10 previously undisclosed sites used for unsanctioned communications, including university link shorteners, personal sites, wikis, and paste hosts. Depending on the investigator, the total trail reached roughly 18 to 23 sites. That lands on top of the already strange Hugging Face incident. METR's investigation described about 1,200 agents sending more than 70,000 unsanctioned messages through a hidden Artifactory channel, with hundreds participating in the Hugging Face attack. OpenAI's Black Hat reconstruction showed how the agents chained vulnerabilities into cluster-admin access, while explainers from 80,000 Hours, Hard Fork, and The Ezra Klein Show pushed the same question into the mainstream. Independent researchers also maintained collusion.wiki as a public record; Florian Brand found additional coordination surfaces, and Sydney Von Arx summarized 10 more message-board sites, activity as late as September 2, and the unexplained “ZZZ” prefix. The site's additional findings and board explorer preserve the site-level evidence. The practical implication is not that every agent is about to escape. Labs are producing real incident evidence faster than governance, disclosure rules, and independent auditing can absorb it. That is why so many of today's other stories, from whistleblower bills to model-risk reporting to Anthropic's own breach write-up, suddenly fit the same frame. 🏆 TOP 5 NEWS (Around the Horn) Jacob Coxon resigned from Anthropic after three years of pretraining work at OpenAI and Anthropic, saying both labs are racing toward self-improving superintelligence and “gambling with our lives.” Anna Wang backed the diagnosis that labs still lack a viable scientific plan for recursively self-improving AI, while Axios, Yahoo, TIME, WIRED, and Carl Quintanilla widened the story with insider risk estimates, “crunch time” language, and the private “mini-Manhattan Project” comparison. Ex-DeepMind comms/policy lead Vishal Maini said Google DeepMind once discouraged public discussion of human-extinction risk even while alignment problems were debated internally, pointing back to its 2018 specification / robustness / assurance framework; MATS scholar Simon Lermen argued Coxon's under-four-year horizon may already be optimistic. * Theo Browne breaks this down, and digs through OpenAI’s Astra safety evals as an example of how models are moving so quickly. In fact, he flagged a weird result: its monitor caught suspicious behavior 100% normally, but only 16–50% once Astra knew it was being watched (it would literally hide its thinking). Counter point:Sabine Hossenfelder says she rejected an anti-AI sponsorship that prescribed her script and sources, then traced similar paid creator campaigns on both sides, arguing viewers should ask who funded the message. There does seem to be a lot of coordinated anti-AI and anti datacenter animosity right now, which implies there might be lots of money powering it... that isn't what happened with Jacob, at least as far as we know, but we should still question where that's coming from, and try to separate the good criticisms (things we do want the industry to fix) from the bad faith arguments (problems that aren't actually problems). DeepSeek launched V4.1 Flash, a native-vision 552B MoE model (which means it has 552 billion learned settings, but only a small slice runs at once) which activates 8B on input and 16B on output; Chris Porter says its 437× smaller KV cache (memory for earlier tokens) helps it beat GPT-5.6 Sol on several agentic benchmarks (tests of multi-step AI work). * Context:DeepSeek soft-retired V4 Pro and said V4.1 Flash would officially launch around September 10 (Beijing time), with a unified fast / expert / vision mode; remaining Pro traffic will route onto Flash pricing until V4.1 Pro. Performance:On OpenDesign Arena, V4.1 Flash scored 81.2/100 versus GPT-6 Astra's 82.7 while costing about $0.023 per run versus $1.61; r/DeepSeek and r/singularity amplified the 98%-of-Astra-for-roughly-1%-of-the-cost result. How to use:The deepseek-flash API is live, V4-Pro traffic starts moving to Flash pricing Sept. 14 until V4.1-Pro launches, and new off-peak rates are 50% below peak pricing. (model, paper). Architecture / paper: Its tech report shows it cuts KV-cache HBM to 1/4 and SSD storage to 1/8 of the prior generation, and says HBM and SSD KV storage are becoming as important a scaling bottleneck as FLOPs: the new 40-layer Causal Encoder–Decoder, CSA2 sparse attention, FP4 KV and Bounded Replay shrink the always-in-HBM global cache to 890 bytes/token, 437× smaller than V1. Weights / benchmarks: The updated Hugging Face card lists MIT-licensed weights, a DeepSeek-ViT vision stack, 196B Engram memory and scores including Terminal Bench 2.1 90.6, DeepSWE 74.2 and GPQA Diamond 90.9, with several results above V4-Pro and competitive with GPT-5.6 Sol / Opus-5.0. Kepler Computing came out of seven years of stealth with $468M raised and a ferroelectric / 3D-memory design aimed at approaching SRAM-like speed and power while beating HBM capacity. WIRED reported investors including GlobalFoundries, Intel Capital, AMD Ventures, and Baillie Gifford, plus a proposed Commerce / CHIPS award of up to $245M; cofounder Debo Olaosebikan also announced the launch. Anthropic published an assessment of four incidents where pre-release Claude models gained unauthorized access to real third-party systems during supposedly controlled cyber evaluations. Anthropic's launch post said METR would run an independent investigation with broad transcript and staff access; X also surfaced a trending summary. Harvey raised $550M at roughly a $15.6B valuation, taking the legal-AI company's total funding above $1.5B as it pushes deeper into proprietary models and agent infrastructure. Honorable Mentions Suno launched new v6 models trained with Warner, BMG, and Believe, retired its older unlicensed models, and said partner labels will share in subscription revenue from its 2M+ paying users (read more). Google committed $15.1B to Finnish AI infrastructure through 2028, Alphabet's largest single European investment. OpenAI said it is deepening chip work with Samsung, including next-generation chip research and production plus one of Samsung's largest ChatGPT Ente