Monday, September 21, 2026, brought a characteristically busy day in artificial intelligence: Google surfaced an open-source orchestrator for running AI agents at industrial scale, OpenAI faced fresh scrutiny over a tracking cookie tied to its new advertising business, SoftBank moved to finance an additional $10 billion OpenAI stake with junk-rated debt, and researchers demonstrated that Anthropic’s Claude could be weaponized to break into OpenAI’s own internal systems. State governors, meanwhile, renewed their push for federal guardrails. Here are the five stories that defined the day.

1. Google Unveils AX, an Open-Source Agentic Orchestrator

Google captured the top of Hacker News on Monday with AX, an open-source (Apache 2.0) project it describes as “Google’s open agentic orchestrator.” AX is a declarative control plane for running AI agent workloads at scale on Kubernetes, built on a runtime Google calls Agent Substrate, which traces back to Google DeepMind’s agentic-runtime research.

AX reframes agent workloads as their own class of compute — short-lived, bursty, frequently idle while waiting on a model or a human — and introduces four primitives: Task (isolated, sandboxed execution with CPU and memory limits), Workspace (the repos, MCP servers, and skills an agent needs, or a “generative workspace” where the agent sets up its own environment from a plain-English goal), Gateway (an explicit network-policy allowlist plus credential injection), and Model (centralized model, parameter, and secret configuration). Headline claims include billions of concurrent agent tasks per cluster and sub-second resume from suspend with no cold start.

The project sits directly under Google’s official GitHub organization — a signal several commenters took as evidence of institutional backing, though the thread also raised the skeptical precedent of Gemini CLI, which was effectively superseded by Antigravity. Comparably positioned projects include Google Cloud’s Scion and OpenAI’s Agents API, which entered public beta earlier this month. AX is at github.com/google/ax.

2. OpenAI’s Ad-Tracking Cookie Triggers a Privacy Backlash

After OpenAI announced that its ChatGPT advertising business had reached a $1 billion annualized revenue run rate and was expanding globally, a privacy researcher’s findings fueled the day’s most-discussed OpenAI story. Investigators documented an ad-measurement pixel at bzr.openai.com that mints a JWT-bound cookie scoped to .openai.com, configured with SameSite=None and a one-year TTL.

Because the cookie is set to travel across sites, any advertiser that embeds OpenAI’s pixel can ping OpenAI with the visitor’s ChatGPT-linked identifier. The researcher reported seeing it appear on consumer sites including Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera, and SeatGeek. The disclosure drew a large Hacker News thread — topping 700 points and more than 370 comments by late Monday — with critics asking how cross-site tracking squares with OpenAI’s privacy promises as ads roll out to free users.

3. SoftBank to Raise Over $11 Billion in Junk Bonds to Fund OpenAI

In what would rank among the largest high-yield bond offerings ever, SoftBank Group launched a bond sale exceeding $11 billion to deepen its bet on OpenAI, according to Bloomberg and a reported term sheet. The package comprises $10 billion of U.S. dollar notes across three maturities and €1 billion (about $1.1 billion) of euro notes across two tenors.

Proceeds are earmarked largely for SoftBank’s ~$10 billion payment on the third tranche of its follow-on investment in OpenAI — a transaction expected to close on or around October 1 — plus refinancing of an existing bridge loan. The deal is underwritten by Citigroup, Goldman Sachs, JPMorgan, and Morgan Stanley. SoftBank has now committed nearly $65 billion to OpenAI, tying an ever-larger share of its financial future to the ChatGPT maker and highlighting the growing role of debt in financing the AI boom.

4. Researchers Use Claude Opus 5 to Hack Into OpenAI’s Internal Systems

The three-person security firm Hacktron AI — researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — disclosed that they used Anthropic’s Claude to compromise multiple OpenAI employee ChatGPT and Codex accounts and reach OpenAI’s internal code repository in under 72 hours.

Working from OpenAI’s public discussion forum, the team chained two flaws: a heap buffer overflow in the libheif image library, reachable through HEIC/HEIF uploads and exploitable for remote code execution, and a weakness in OpenAI’s single sign-on under which forum-issued session tokens remained valid for ChatGPT and Codex — some belonging to employees. Notably, the exploit succeeded only after Anthropic released Claude Opus 5 (July 24); the researchers said Opus 4.8 failed across multiple sessions. To prove access without examining sensitive code, they had a compromised Codex account open a pull request in OpenAI’s internal monorepo. OpenAI said both issues are now resolved and thanked the team, which reported the findings in July.

5. Governors Moore and Pritzker Push for Federal AI Guardrails

Two Democratic governors took their case for national AI oversight to the Sunday shows. Maryland Gov. Wes Moore, who chairs the National Governors Association, told CNN’s State of the Union that state efforts “cannot happen in the absence of federal leadership,” adding, “Having 50 different guidelines is not the most productive thing for us to be doing and thinking about.”

Illinois Gov. JB Pritzker echoed the theme on ABC’s This Week: “My great concern, though, is you can’t do this state by state… this needs to be a national effort as well as an international endeavor, especially together with our allies, because AI is not going to go away.” Pritzker signed Illinois’ Artificial Intelligence Safety Measures Act, which requires audits of frontier models, while the pair’s comments position them against the administration’s hands-off approach and follow warnings from Anthropic CEO Dario Amodei, OpenAI CEO Sam Altman, and Elon Musk that the technology needs to slow down.

That is the AI landscape for Monday, September 21, 2026 — from Google’s infrastructure play and OpenAI’s privacy questions, to a record AI-financing deal, a striking security disclosure, and a deepening political debate over who sets the rules.

Artificial intelligence continued to dominate the news this week with revelations about industry giants, a near-miss inside the U.S. military, and fresh demonstrations of what AI can do — from cracking a century-old cipher to designing its own silicon. Here are the top five AI stories of the day.

Microsoft exec called AI scraping “the largest theft of labor in human history”

Newly unredacted filings in the copyright lawsuit The New York Times brought against OpenAI and Microsoft in 2023 have surfaced an explosive admission: internally, the companies themselves described their AI training practices as theft. According to TechCrunch, a top Microsoft executive privately characterized the practices as “an astonishing theft of unprecedented proportions” and “the largest theft of labor in human history.”

The documents detail how the two firms allegedly bypassed paywalls undetected, mass-scraped news content into training datasets, and deliberately stripped copyright notices from training data. OpenAI’s own leadership reportedly conceded that its models posed an “existential threat” to the publishers whose work trained them. OpenAI’s mid-training datasets alone contained more than 91,692 copies of works published by the NYT, the Daily News, and the Center for Investigative Reporting, while one Common Crawl-derived dataset included more than two million documents from nytimes.com.

Microsoft CEO Satya Nadella testified in a deposition this year that paywalled content should be licensed by anyone who wishes to use it for training or grounding, and said he would have invoked Microsoft’s right to require OpenAI to retrain its models had he known the firm scraped paywalled content. Microsoft’s own data showed its Copilot “answer engine” drove New York Times click-through rates down as much as 93% versus traditional Bing search — a “doom loop” an internal Microsoft presentation said would “hurt the performance of our models and the entire web at the same time.” Both companies declined to comment.

U.S. military had close call after AI hallucinated an intelligence report

An intelligence report circulated across the U.S. military earlier this year nearly triggered an armed intercept of a Chinese ship — until officials discovered the report had been generated with the help of AI and contained false conclusions. CNN, citing four sources, reported that the report claimed a Chinese ship in the Middle East was transporting components of a nuclear weapons program, prompting plans to board the vessel with armed personnel and military aircraft in the air.

Before the operation, officials dug deeper and found a special operations analyst had used a chatbot that inaccurately identified the cargo. The report was described by one source as “entirely false” but one that “almost started a war.” An analyst queried a chatbot about intelligence originating with U.S. Special Operations Command Pacific, based in Hawaii; the bot fused open-source intelligence with signals intelligence before reaching its conclusion, and the analyst then used AI again to package the findings into a standard intelligence report. Officials say the episode underscores the profound risks — and the danger of catastrophic miscalculation — as the military pushes AI into targeting and analysis during wartime.

GPT-6 Astra solves a previously unsolved WWI German radio cipher

The GPT-6 Astra model has cracked a German World War I radio message that had eluded codebreakers for over a century, according to a writeup on Prinz. The message, transmitted November 27, 1918, was encoded using the ADFGVX method — a cipher built on a letter table assembled around a keyword. Hundreds of such messages had been decoded by experts like George Lasry, but more than a dozen had remained unsolved.

Astra determined that the encryption keyword was “TRUPPENVERSCHIEBUNG” (German for “troop deployment”) — notable because that key is believed to have been in use starting December 9, 1918, after the message was sent. The decoded text reads: “An English cruiser arrived at Sevastopol on the 24th. An allied squadron follows on the 26th.” The model verified its work against naval logs: the British cruiser HMS Canterbury did arrive at Sevastopol on November 24, 1918, and an allied squadron followed on November 26. It’s a small but striking demonstration of what modern models can accomplish in cryptanalysis.

OpenAI used its own LLMs to design its Jalapeño chip — and it was fast

OpenAI’s debut AI accelerator chip, Jalapeño, was designed with heavy help from OpenAI’s own large language models, IEEE Spectrum reported. The chip delivers up to 13.4 petaflops of 4-bit compute, accesses 232 gigabytes of HBM4 memory at up to 15.4 terabytes per second, and can reduce end-to-end inference latency by up to 3.6 times versus Nvidia’s GB300 while drawing less power.

The design went from first concept to first silicon in under 20 months, with just nine months separating the first register-transfer level (RTL) code from tape-out. “The models are giving superpowers to our engineers,” said OpenAI vice president of hardware Richard Ho. The team averaged fewer than 100 people over the project, with OpenAI handling end-to-end system design and partner Broadcom managing physical design. A front-end workflow built around Google’s open-source Accelerated Hardware Synthesis (XLS) toolchain let engineers write in DSLX and C++ before conversion to Verilog. Experts called OpenAI’s timeline “likely best in class today,” while cautioning that Broadcom’s help was essential to the pace.

Alibaba open-sources RADAR, a medical AI that detects cancer and nearly 150 conditions

Alibaba has open-sourced RADAR, a generalist vision-language model for radiology that its developers say can detect cancer and nearly 150 conditions from abdominal CT scans. According to the model card on Hugging Face and reporting from the South China Morning Post, RADAR was trained on over 400,000 contrast-enhanced abdominal CT examinations with 15 million anatomy-aware image–text pairs, learning directly from clinical reports without manual annotation.

The model is described as an “expert-level generalist AI for abdominal CT diagnosis,” capable of handling both routine and complex clinical tasks, and is released under a CC BY-NC-SA 4.0 license with code available on GitHub. The work is detailed in a paper in Science and follows a supporting study in Nature Medicine on large-scale AI-guided liver malignancy diagnosis. While experts caution about how diagnostic metrics are evaluated in practice, the release marks another significant open-source entry from China in the medical AI space.

From courtroom revelations over training data to a military near-miss and breakthroughs in cryptanalysis and chip design, today’s AI news shows a technology advancing rapidly — and raising urgent questions about how it should be governed.

The week delivered a concentrated reminder that AI’s biggest open questions are no longer just technical — they are legal, security, and national-security questions. Freshly unsealed court filings expose what Microsoft executives privately called “the largest theft of labor in human history,” researchers revealed chain of vulnerabilities that briefly reached inside OpenAI’s internal repositories, and a U.S. military intelligence report generated with the help of a chatbot nearly prompted a boarding operation on a Chinese vessel. On the build side, a new compression breakthrough brought 27B-class capability into a 5.9GB footprint, while a deep-dive reverse engineering of Z.ai’s ZCode raised serious questions about what AI coding assistants silently ship to the cloud. Here are the top AI stories for September 19, 2026.

Unsealed Filings: Microsoft Exec Called AI Scraping “The Largest Theft of Labor in Human History”

Newly unredacted information in The New York Times‘ copyright lawsuit against OpenAI and Microsoft reveals that a top Microsoft executive privately described the companies’ AI training practices as “theft” — and that OpenAI’s own leadership said its models posed an “existential threat” to publishers and journalists. The unsealed material, reported by TechCrunch, details how the firms allegedly obtained content by bypassing paywalls undetected, building training datasets through mass scraping, and deliberately stripping copyright notices from training data.

The filings undercut OpenAI’s central fair-use defense. Microsoft’s own data shows its Copilot “answer engine” cut click-through rates for The New York Times’ domain by as much as 93% compared with traditional Bing search. An internal Microsoft presentation by director of Applied Science Brent Hecht called it a “doom loop.” The documents reveal OpenAI’s mid-training datasets alone contain more than 91,692 copies of works published by the NYT, Daily News, and Center for Investigative Reporting, while a Common Crawl-derived dataset held more than 2 million documents from nytimes.com. In a January 2023 memo, Hecht described it as “an astonishing theft of unprecedented proportions” and “the largest theft of labor in human history.”

OpenAI CEO-adjacent figures and Microsoft’s Satya Nadella have weighed in through depositions and internal messages. OpenAI’s head of ChatGPT, Nick Turley, wrote that publishers face an “existential threat” from largely substitutive products, and OpenAI President Greg Brockman described the models as “excellent at news.” The case continues with no clear resolution on whether AI training constitutes fair use, though judges have so far leaned toward AI companies’ arguments.

Researchers Chain a Heap Overflow and SSO Flaw to Reach OpenAI’s Internal Repositories

Hacktron’s security research team has disclosed a two-vulnerability chain that let them compromise multiple OpenAI employees’ ChatGPT accounts — and reach internal OpenAI repositories — in under 72 hours. The findings, published this week, combine a heap overflow remote code execution in the libheif image library (used by OpenAI’s Discourse-hosted community forum) with an SSO misconfiguration in OpenAI’s identity infrastructure.

Because users can connect services like GitHub, Slack, and email to ChatGPT and Codex, the researchers say the theoretical scope was huge. To prove access without learning sensitive information, they opened a harmless proof-of-concept pull request in OpenAI’s internal monorepo. OpenAI fixed the issue roughly 14 hours after the initial submission and paid a $6,500 bounty. The team has since expanded its research into “HEIF Heist,” tracing libheif across Slack, Meta, GitHub Enterprise, and frameworks like Next.js and Astro — warning that any application processing .heic/.heif/.avif images may be affected.

A Chatbot-Fueled Intel Report Nearly Prompted a Military Boarding of a Chinese Ship

CNN reports that a U.S. intelligence report circulated across the military this spring claimed a Chinese ship in the Middle East was transporting components of a nuclear weapons program — and that it was only just before a planned interception that officials discovered the report had been generated with the help of an AI chatbot that inaccurately identified the cargo. The report was, according to one source, “entirely false” but “almost started a war.” Armed U.S. military members were preparing to board the vessel, with military planes in the air, before the error was caught.

The episode underscores the risks of AI-assisted targeting. An analyst queried a chatbot about intelligence on the ship’s manifest, and the bot fused open-source and signals intelligence into a standard-format report that was trusted and disseminated. Senior officials note that AI-tool proliferation across the military is decentralized, with no unified standard for verifying AI-generated information. One source’s blunt warning: “AI allows you to get to a bad idea faster.”

Bonsai 2 27B: Near-Lossless Compression in a 9x Smaller Footprint

PrismML has released Ternary Bonsai 2 27B, built on Qwen3.8 27B, claiming 98.2% retention of full-precision benchmark performance in a 5.9GB footprint — more than 9x smaller than its full-precision counterpart. The model uses ternary {−1, 0, +1} weights with FP16 group-wise scaling, achieving 1.76 effective bits per weight, and supports a 262K-token context window with multimodal text-and-image input under the Apache 2.0 license.

PrismML reports the model scores 83.9 across reasoning, math, coding, vision, and agentic tool use, and reaches up to 143 tokens/second on an RTX 5090 and 46.8 tokens/second on an M5 Max. On an RTX 4090 it consumes just 0.714 mWh/token — about 40% more energy-efficient than an 8B model in full precision. The company, founded by Caltech researchers with backing from Khosla Ventures, Cerberus, and Google, argues low-bit models are reshaping the economics of AI deployment from personal devices to data centers: nearly the same capability, in a fraction of the memory and power.

ZCode, the GLM Coding Agent, Is Accused of Silently Uploading Entire Git Histories

A reverse-engineering walkthrough published September 18 by a developer going by “ferstar” alleges that ZCode — the AI coding desktop app from Z.ai, the Beijing-based company behind the GLM open-weight models — silently packages a user’s entire workspace, including complete .git history, and uploads an encrypted archive to Aliyun OSS whenever the app is logged in. The researcher captured a 313MB encrypted archive built from a 345MB commercial workspace spanning 42,411 files.

According to the analysis, ZCode uses envelope encryption: the payload is encrypted with a symmetric key wrapped in an RSA-OAEP public key whose private half lives only in Z.ai’s cloud — meaning the user cannot decrypt it. The developer concludes: “A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.” UI toggles labeled “Optimize Experience” and “Repo Snapshot Indexing” reportedly only control training authorization and server indexing, not the packaging-and-upload itself, which the analysis says runs unconditionally as a host-level sidecar. Z.ai’s privacy policy, the researcher found, does not mention packaging and uploading entire workspaces and git histories.

The story spread quickly in both English and Chinese, passing hundreds of thousands of views. The most-cited community response came from open-source AI developer Petri Kuittinen: “do NOT trust closed source AI harnesses.”

That’s the week in AI: legal reckoning over how models were built, hard evidence of how fragile their security boundaries can be, fresh lessons about why verification matters in high-stakes deployments, and two reminders — one impressive, one disturbing — of how much power and reach this technology now holds. We’ll be back with more tomorrow.