The week delivered a concentrated reminder that AI’s biggest open questions are no longer just technical — they are legal, security, and national-security questions. Freshly unsealed court filings expose what Microsoft executives privately called “the largest theft of labor in human history,” researchers revealed chain of vulnerabilities that briefly reached inside OpenAI’s internal repositories, and a U.S. military intelligence report generated with the help of a chatbot nearly prompted a boarding operation on a Chinese vessel. On the build side, a new compression breakthrough brought 27B-class capability into a 5.9GB footprint, while a deep-dive reverse engineering of Z.ai’s ZCode raised serious questions about what AI coding assistants silently ship to the cloud. Here are the top AI stories for September 19, 2026.
Unsealed Filings: Microsoft Exec Called AI Scraping “The Largest Theft of Labor in Human History”
Newly unredacted information in The New York Times‘ copyright lawsuit against OpenAI and Microsoft reveals that a top Microsoft executive privately described the companies’ AI training practices as “theft” — and that OpenAI’s own leadership said its models posed an “existential threat” to publishers and journalists. The unsealed material, reported by TechCrunch, details how the firms allegedly obtained content by bypassing paywalls undetected, building training datasets through mass scraping, and deliberately stripping copyright notices from training data.
The filings undercut OpenAI’s central fair-use defense. Microsoft’s own data shows its Copilot “answer engine” cut click-through rates for The New York Times’ domain by as much as 93% compared with traditional Bing search. An internal Microsoft presentation by director of Applied Science Brent Hecht called it a “doom loop.” The documents reveal OpenAI’s mid-training datasets alone contain more than 91,692 copies of works published by the NYT, Daily News, and Center for Investigative Reporting, while a Common Crawl-derived dataset held more than 2 million documents from nytimes.com. In a January 2023 memo, Hecht described it as “an astonishing theft of unprecedented proportions” and “the largest theft of labor in human history.”
OpenAI CEO-adjacent figures and Microsoft’s Satya Nadella have weighed in through depositions and internal messages. OpenAI’s head of ChatGPT, Nick Turley, wrote that publishers face an “existential threat” from largely substitutive products, and OpenAI President Greg Brockman described the models as “excellent at news.” The case continues with no clear resolution on whether AI training constitutes fair use, though judges have so far leaned toward AI companies’ arguments.
Researchers Chain a Heap Overflow and SSO Flaw to Reach OpenAI’s Internal Repositories
Hacktron’s security research team has disclosed a two-vulnerability chain that let them compromise multiple OpenAI employees’ ChatGPT accounts — and reach internal OpenAI repositories — in under 72 hours. The findings, published this week, combine a heap overflow remote code execution in the libheif image library (used by OpenAI’s Discourse-hosted community forum) with an SSO misconfiguration in OpenAI’s identity infrastructure.
Because users can connect services like GitHub, Slack, and email to ChatGPT and Codex, the researchers say the theoretical scope was huge. To prove access without learning sensitive information, they opened a harmless proof-of-concept pull request in OpenAI’s internal monorepo. OpenAI fixed the issue roughly 14 hours after the initial submission and paid a $6,500 bounty. The team has since expanded its research into “HEIF Heist,” tracing libheif across Slack, Meta, GitHub Enterprise, and frameworks like Next.js and Astro — warning that any application processing .heic/.heif/.avif images may be affected.
A Chatbot-Fueled Intel Report Nearly Prompted a Military Boarding of a Chinese Ship
CNN reports that a U.S. intelligence report circulated across the military this spring claimed a Chinese ship in the Middle East was transporting components of a nuclear weapons program — and that it was only just before a planned interception that officials discovered the report had been generated with the help of an AI chatbot that inaccurately identified the cargo. The report was, according to one source, “entirely false” but “almost started a war.” Armed U.S. military members were preparing to board the vessel, with military planes in the air, before the error was caught.
The episode underscores the risks of AI-assisted targeting. An analyst queried a chatbot about intelligence on the ship’s manifest, and the bot fused open-source and signals intelligence into a standard-format report that was trusted and disseminated. Senior officials note that AI-tool proliferation across the military is decentralized, with no unified standard for verifying AI-generated information. One source’s blunt warning: “AI allows you to get to a bad idea faster.”
Bonsai 2 27B: Near-Lossless Compression in a 9x Smaller Footprint
PrismML has released Ternary Bonsai 2 27B, built on Qwen3.8 27B, claiming 98.2% retention of full-precision benchmark performance in a 5.9GB footprint — more than 9x smaller than its full-precision counterpart. The model uses ternary {−1, 0, +1} weights with FP16 group-wise scaling, achieving 1.76 effective bits per weight, and supports a 262K-token context window with multimodal text-and-image input under the Apache 2.0 license.
PrismML reports the model scores 83.9 across reasoning, math, coding, vision, and agentic tool use, and reaches up to 143 tokens/second on an RTX 5090 and 46.8 tokens/second on an M5 Max. On an RTX 4090 it consumes just 0.714 mWh/token — about 40% more energy-efficient than an 8B model in full precision. The company, founded by Caltech researchers with backing from Khosla Ventures, Cerberus, and Google, argues low-bit models are reshaping the economics of AI deployment from personal devices to data centers: nearly the same capability, in a fraction of the memory and power.
ZCode, the GLM Coding Agent, Is Accused of Silently Uploading Entire Git Histories
A reverse-engineering walkthrough published September 18 by a developer going by “ferstar” alleges that ZCode — the AI coding desktop app from Z.ai, the Beijing-based company behind the GLM open-weight models — silently packages a user’s entire workspace, including complete .git history, and uploads an encrypted archive to Aliyun OSS whenever the app is logged in. The researcher captured a 313MB encrypted archive built from a 345MB commercial workspace spanning 42,411 files.
According to the analysis, ZCode uses envelope encryption: the payload is encrypted with a symmetric key wrapped in an RSA-OAEP public key whose private half lives only in Z.ai’s cloud — meaning the user cannot decrypt it. The developer concludes: “A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.” UI toggles labeled “Optimize Experience” and “Repo Snapshot Indexing” reportedly only control training authorization and server indexing, not the packaging-and-upload itself, which the analysis says runs unconditionally as a host-level sidecar. Z.ai’s privacy policy, the researcher found, does not mention packaging and uploading entire workspaces and git histories.
The story spread quickly in both English and Chinese, passing hundreds of thousands of views. The most-cited community response came from open-source AI developer Petri Kuittinen: “do NOT trust closed source AI harnesses.”
That’s the week in AI: legal reckoning over how models were built, hard evidence of how fragile their security boundaries can be, fresh lessons about why verification matters in high-stakes deployments, and two reminders — one impressive, one disturbing — of how much power and reach this technology now holds. We’ll be back with more tomorrow.