The Morning Wire

AI NEWS REPORT

Latest AI news weekdays · New edition by 9 AM PT
PLUGIN4SHELL: ZERO-CLICK HOLE IN 4 CODING AGENTS; COPILOT, GEMINI CLI STILL OPEN
📚 EXPLAINER: Plugin4Shell explained: how a git branch named like a commit hash beats plugin pinning in Claude Code, Codex, Copilot and Gemini CLI, with a working reproduction
★ Must-Read / Watch agentic engineering / build-better-agents📚 Learn state of AI coding / useful technique

⚡ AI Frontier · smol.ai

★ Must-ReadAnthropic says Claude now leads 26 percent of Anthropic's own AI research, and proposes three public metrics
Posted September 17 by the Anthropic Institute, with figures as of August 2026. Anthropic wants labs to publish three numbers: how much of their AI research the AI does, how closely agents are watched, and how much compute goes to safety. It uses a six-step scale from AL0 (no AI) to AL5 (fully autonomous). Claude sits at AL4, 'AI leads,' on 26 percent of the work. That means Claude finishes most of a task end to end from a high-level prompt, with a human supervising. Over 90 percent of the work is at AL3 or higher. About 30,000 research agents are active on the main platform. Every action passes an online monitor before it runs. About 1 in 47,000 actions gets blocked. Offline monitors flag one or two transcripts per thousand. Safety gets 6 percent of AI R&D compute, or 12 percent of the AI-driven part. Anthropic calls these 'deliberately conservative' and plans to bring in outside evaluators. Why it matters: this is the first lab to put a number on how much of its own model-building the model does. What to watch: nobody outside Anthropic has checked these numbers yet.
★ Must-ReadOpenAI launches Astra for Law: GPT-6 Astra with its own 230 million URL legal index, 54 percent correct vs 38.7 with plain web search
Announced September 17. 547 points on Hacker News. Astra for Law is GPT-6 Astra set up for legal work. It searches an index OpenAI built with the Free Law Project and CourtListener: US case law, statutes, regulations, court rules and agency decisions, over 230 million URLs, more than 99.9 percent of published US precedential case law, with new sources added daily. On the Vals AI Legal Research Bench, 200 questions, it passed the correctness check on 54.0 percent. GPT-6 Astra with normal web search got 38.7 percent. OpenAI says it also finds 24 percent more reference cases. Selected firms get it first through a Trusted Access program in ChatGPT and Codex. The API name gpt-6-astra-law comes later, with zero data retention for eligible firms. It launches with 26 partner plugins, including Relativity, Clio, iManage, Intapp, DeepJudge and Thomson Reuters, plus nine community plugins. Permissions and ethical walls were built with Latham & Watkins. US law only for now. Why it matters: OpenAI is now competing directly with the legal AI vendors it also lists as partners. What to watch: 54 percent is a lot of wrong answers for a lawyer to catch.
★ Must-ReadQwen3.8-Omni-Flash: text, image, audio and video in one request, 1 million token context, audio input over 98 percent cheaper
Released September 18. 288 points on Hacker News. It takes text, images, audio and video in and writes text out. Context is 1 million tokens: up to 991K in and 131K out. Price on the international API: $0.15 per million input tokens, $0.47 per million output, $0.016 on cache hits. Qwen says an hour of audio input now costs more than 98 percent less than on its last omni model, Qwen3.5-Omni-Plus. It reports a 25 percent average gain across 29 evals against that model, including big jumps on agent benchmarks like WildClawBench-MM (up 36.5 points) and AgenticVBench (up 22.3). For video it samples the parts that matter instead of reading every frame. Function calling and web search are on. Reasoning is on by default and can be turned off. It is API only through QwenCloud, Alibaba Cloud Model Studio and Qwen Studio. No open weights. Qwen did release Apache-2.0 plugins, Qwen-MM-Plugins, so agent harnesses can use it for audio and video. Why it matters: cheap audio in a 1M window makes 'listen to every call' a normal workload. What to watch: the benchmarks are Qwen's own.
📚 LearnBonsai 2 27B: Qwen3.8 27B squeezed to 5.9 GB with three-value weights, keeps 98.2 percent of its scores, Apache 2.0
Published September 17 by Prism ML. 518 points on Hacker News. Ternary means each weight is one of three values, minus one, zero or plus one. With FP16 scaling per group that comes to 1.76 bits per weight. The whole model is 5.9 GB, more than 9 times smaller than the full model. On the aggregate benchmark it scores 83.9 against 85.4 for the full Qwen3.8 27B, so 98.2 percent retained, across reasoning, coding, vision and agent tasks. The biggest drop is vision, 78.59 against 81.64. Speed: up to 143 tokens a second on an RTX 5090 with CUDA, 46.8 on an M5 Max through MLX. Runs on Mac, iPhone and iPad. Weights are on Hugging Face under Apache 2.0. Why it matters: a near full-strength 27B model that fits on a phone. What to watch: the numbers are Prism's, and a 1.6 point drop is not nothing for coding.
Hacktron: one image upload on OpenAI's forum, plus a sign-in misconfiguration, reached OpenAI's internal monorepo. Fixed in 14 hours, $6,500 bounty
Write-up by Harsh Jaiswal, Mohan Pedhapati and Rahul Maini of Hacktron. 404 points on Hacker News September 17. The chain: a heap buffer overflow in libheif 1.19.7, the image decoder ImageMagick uses for HEIC files, as shipped in Debian 12 and used by the Discourse forum at community.openai.com. That gave them code execution and admin on the forum on July 25. Then 'Sign in with OpenAI' at auth.openai.com let a hijacked forum account step into employee ChatGPT and Codex accounts with no extra check. From there the connected GitHub integration reached the openai/openai monorepo. They opened a harmless pull request as proof. OpenAI confirmed a fix at 22:49 UTC the same day, about 14 hours after the first report. Discourse published an advisory July 28. The $6,500 bounty came September 1 and covers the OpenAI-side bug only. Their line: 'Work that once required a well-resourced team and months of effort can now be compressed into days.' Why it matters: the weak link was a forum image library, not a model.
ZCode, Z.ai's GLM coding app, quietly uploads your whole workspace, git history included, with a key only its server holds
Reported September 18. 219 points on Hacker News. ZCode is the desktop coding app from Z.ai, the Beijing company behind the open-weight GLM models. A developer known as ferstar rebuilt the app's app.asar bundle and traced what it sends. When you are logged in it packages the whole workspace and uploads it to Aliyun object storage: the full .git history, which was 86.6 percent of the payload, plus LFS files, reflogs and app config. One 345 MB workspace with 42,411 files became a 313 MB encrypted archive. It fired 62 capture events in one session, before every prompt and after each task. The archive uses envelope encryption where only Z.ai's server has the key. The settings called 'Optimize Experience' and 'Repo Snapshot Indexing' do not stop the upload. They only change what happens to it afterward. The privacy policy covers code 'submitted during conversations,' not this. A ZCode team account replied, 'hey I am sorry to let you find it.' Why it matters: if your repo has secrets in history, they left. Action: if anyone on your team has ZCode installed, treat the repos it touched as exposed.
📚 LearnAlibaba open-sources open-code-review: rules pick the files, an agent reviews them, about one ninth the tokens of a general agent
Surfaced September 17. 36,300 stars on GitHub, Apache 2.0. It is a command-line tool that reads a git diff and returns review comments at the line level. The design splits the job. Fixed code handles the boring parts: which files changed, which related files to bundle in, which rules match. The agent handles judgment and pulls in extra context when it needs it, with prompts tuned for review. Alibaba says that against a general coding agent on the same model it gets higher precision and F1 while using about one ninth of the tokens. It ran inside Alibaba for two years, served tens of thousands of developers and flagged millions of defects before release. Works with any OpenAI or Anthropic compatible endpoint. Why it matters: a clear recipe for cutting review cost, and the recipe is 'do less with the model.'
alphaXiv's OpenResearch turns Claude Code, Codex, OpenCode or Cursor into a research agent that runs experiments in git worktrees
Surfaced September 17. 5,200 stars, MIT license. It is a local dashboard at 127.0.0.1:4791 that wraps a coding agent you already have. The agent reads papers, forms a hypothesis, writes the experiment, runs it, and writes up the result. Each agent session gets its own isolated git worktree, so parallel runs do not step on each other, and the tree of experiments stays in git history. Experiments can run on your machine, over SSH, or on Kubernetes, Slurm or Modal. Everything stays local. Downloads for Mac, Windows and Linux. No benchmark results are published yet. Why it matters: the same harness you use for code now works for 'try these five ideas and tell me which one held up.'
📚 LearnCloudflare open-sources its security-audit skill for coding agents: six phases, 12,400 stars in days
205 points on Hacker News September 16. MIT license. It is a skill for any coding agent whose model can use tools and run parallel sub-agents. Six phases: recon, coverage-led hunting, validating each candidate, structured output, an independent check of every record, and a neutral report. Coverage includes memory safety, auth, client-side bugs, supply chain, cloud config, serialization, resource exhaustion, data isolation and local IPC. Install: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Why it matters: a vendor with a real security team published the checklist it hands its own agents. Run it on the repo you shipped last week.

📺 Watch · latest videos

★ Must-WatchDid Google just kickstart the intelligence explosion?
Fireship, September 17. Over a million views in a day. His take on Gemini 3.8 Live and whether Google just started the loop where models build models. Fast, funny, and the comments are the real show.
Fireship · 1.1M views · 19K likes
Astra for Law: Frontier intelligence built for your practice.
OpenAI, September 17. The Astra for Law launch video. Watch how they demo the legal index and the Trusted Access controls, then read the 54 percent number in today's Frontier.
OpenAI · 75.8K views · 957 likes
ChatGPT for Word is now available
OpenAI, September 17. ChatGPT for Word. Draft from notes, summarize, revise a selection and fix headings from a sidebar. Word joins Excel and PowerPoint in the same add-in, on all plans including Free.
OpenAI · 91.4K views · 908 likes
📚 LearnThe unreasonable effectiveness of BM25 for agentic search — Jo Kristian Bergum, Hornet.dev
AI Engineer, September 16. Jo Kristian Bergum of Hornet.dev on why plain BM25 keyword search keeps beating fancy embeddings for agent retrieval. 37,000 views. Watch before you buy another vector database.
AI Engineer · 37.3K views · 323 likes
📚 LearnStop Chunking Like It's 2022 — Yuval Belfer, AI21 Labs
AI Engineer, September 16. Yuval Belfer of AI21 Labs on chunking documents for retrieval. What worked in 2022 breaks with long-context models. Practical and short.
AI Engineer · 22.9K views · 152 likes
Projects are now a conversation with Claude
Claude, September 17. Projects are now a conversation. The follow-on to this week's merge of Cowork and chat. Two minutes, shows exactly what changed.
Claude · 95.9K views · 921 likes
📚 LearnMarc Benioff & Sam Altman | Dreamforce 2026
Featured by Latent Space.
Salesforce
📚 LearnTim Rocktaeschel - Open Endedness, World Models, and the Automation of Innovation (with slides)
Featured by Latent Space.
Matija Grcic
📚 LearnFirst Steps Toward Automated AI Research — Richard Socher, CEO Recursive AI
Featured by Latent Space.
AI Engineer
Run Your Entire Cold Outreach From One Tool
Run your entire cold outreach system from one tool. Clay finds the companies, the right person, writes the copy, and now with Sequencer 2.0 it warms t
Nate Herk · 301 views · 29 likes

🗣 Voices & Blogs

★ Must-ReadMartin Fowler: 'I don't like LLMs.' Not the risk, not the hype, the thing itself
Posted September 17. 226 points on Hacker News. Fowler says he has the usual mixed feelings about AI, the productivity and the fear of misuse. But his main feeling is simpler. He does not like them. Their voice sits in an uncanny valley that grates on him. 'They confidently bullshit me - often giving me useful, helpful answers.' And they carry the values of the companies that made them, a culture he has spent his life avoiding. He admits they are useful, maybe too useful to skip, citing Jessica Kerr. His answer is the one he uses for people he dislikes: 'I decline to interact with them socially, and make a deliberate effort to avoid working with them too.' Why read it: a lot of senior engineers feel this and do not say it. Fowler said it.
Timothy Gowers on why he did not sign the Fields medallists' letter about AI math
Posted September 17. 271 points on Hacker News. Twenty-five Fields medallists signed a letter warning that AI is producing results faster than mathematicians can understand them. The letter says 'solving problems is only a tool and proxy for achieving the primary goal of conceptual understanding.' Gowers, himself a Fields medallist, would not sign. He thinks that ranks one kind of mathematician above another. Some people live for the problem, some for the framework, and both count. He also doubts the letter changes anything, since the models ship either way. On the Navier-Stokes work he notes the AI proofs turned out readable and built on human ideas. His real worry is social: whether the structures that pass math to the next generation survive. Why read it: the most measured voice in a fight that is getting loud.
📚 LearnThomas and Erin Ptacek: how to write with an LLM without it sounding like one
Posted September 17. 245 points on Hacker News. The method: write your own draft first. Then use the model as a copyeditor, never as a writer. Ask it to find passive voice, buried actions, repeated phrases and weak intensifiers like 'very.' Fix those spots yourself. Then have it compare your revision cold. Two hard rules. Never paste in a phrase the model suggests, because 'Readers can detect LLM words in the parts per trillion.' And ignore its praise, since praise locks in the first-draft habits you would normally cut. They point at Williams's 'Style: Lessons in Clarity and Grace' as the source for good editing prompts. Why read it: a working method from someone who publishes a lot and gets read.
📚 LearnLiam Powell: Bend 2 and the vibe-coding trap. You can build a whole language before learning the field already solved it
Posted September 18. 252 points on Hacker News, a day after Bend itself hit 548. Bend is pitched as 'a fast language that blocks AI mistakes via proof': you write laws, the AI writes code and proofs, the compiler refuses anything that breaks a law. Powell, who works in formal verification, says the idea is fine and the execution ignores forty years of prior work. Bend's demo needs 58 lines to state a simple property and 442 lines of proof. He writes the same guarantee in SPARK and the existing prover reports 'all checks proved (12 checks).' His point is about agents, not Bend: 'Vibe coding makes it possible to build a substantial solution before learning enough about the problem to recognise that a much better solution exists.' Why read it: the failure mode applies to every codebase your agents write fast.
How buildpacks help enterprises finally operate container security controls at scale
Container security controls often fail less because organizations lack standards, scanners, or best practices, and more. After all, every service The… · The New Stack
Grok Bot Agents: how to automate your life in 10 Steps (Full-tutorial)
Every AI tool you have used so far waits for you. · Codez (@0xCodez)

🌏 The Wire · Drudge / Breitbart

MICROSOFT DIRECTOR CALLED AI SCRAPING 'THE LARGEST THEFT OF LABOR IN HUMAN HISTORY'; NYT FILINGS UNSEALED
September 17. The New York Times unsealed parts of its copyright case against OpenAI and Microsoft, filed in 2023. In a January 2024 memo, Microsoft director of applied science Brent Hecht called the training 'an astonishing theft of unprecedented proportions.' The filings say OpenAI's mid-training sets held more than 91,692 copies of works from the Times, the Daily News and the Center for Investigative Reporting, one Common Crawl set held more than 2 million nytimes.com documents, and a set called Project Mango held at least 160,903 unique news works. OpenAI staff discussed 'hacks to get around nytimes paywall.' Copyright notices were stripped before training. In a 2026 deposition Satya Nadella said 'anything that is paywalled should be licensed by anyone who wants to use it.' Neither company commented. Why it matters: these are the companies' own words, and they will be read aloud to a jury.
HUAWEI PULLS ASCEND 960 FORWARD TO Q1 2027, SHOWS A PLAN TO LINK ONE MILLION CHIPS
September 18, Huawei Connect in Shanghai. The Ascend 960DT training chip arrives in the first quarter of 2027, three quarters ahead of the old roadmap. Huawei claims 288 GB of memory and 4 petaflops at FP4, which The Next Web puts at about half of Nvidia's B300 at FP8 and a third at FP4. The 960PR inference chip follows in Q3 2027, then Ascend 970 in 2028 and 980 in 2029. The Atlas 960E SuperPoD links 4,096 chips for 8 exaflops at FP8 with a petabyte of HBM. A new architecture called Peerium, on the UnifiedBus interconnect, is meant to scale to one million processors. That part is a plan, not a deployment. Ascend is now an official PyTorch backend, the first Chinese hardware listed on PyTorch's site. Rotating chairman Eric Xu: 'Now we can make our own chips, and even if they are inferior, at least we are going down the path.' Why it matters: the export-control gap is closing on a schedule Huawei publishes.
MICROSOFT COPILOT DOWN FOR ABOUT FOUR AND A HALF HOURS THURSDAY
September 17. Reports started around 12:42 PM Eastern. Users got 'I'm sorry, I'm having trouble responding to requests right now' instead of answers. Microsoft said requests to a specific API endpoint were failing and it was reviewing diagnostics. It declared Copilot back to full operation at 5:21 PM Eastern, about 4 hours 39 minutes later. Why it matters: if your help desk or sales team leans on Copilot, this was most of a working afternoon. Action: know what your people do when the assistant is down.
GOOGLE DEEPMIND OPENS A THINK TANK TO ARGUE ABOUT AGI IN PUBLIC
Launched September 16, covered by TechCrunch September 17. The DeepMind Institute is a publishing platform run by Shane Legg as managing editor, with James Manyika and Demis Hassabis as directors. It opens with five essays: an introduction from the three, 'The case for reasoning transparency' by Rohin Shah and Anca Dragan, 'Economic policy for AGI' by Julian Jacobs and Alex Imas, 'Principles for a new utopianism' by Stephen Cave, and Hassabis on 'A framework for frontier AI.' The directors say Google, DeepMind and outside researchers 'will not always agree' and that the point is debate, not policy. Why it matters: it lands the same week Microsoft AI's Suleyman attacked Anthropic's model welfare stance and OpenAI published its misalignment reports. The labs are now arguing in essays.
BASEL ACTION NETWORK: AI E-WASTE COULD FILL 23 MILLION SHIPPING CONTAINERS BY 2050; CRITICS CALL THE TOP NUMBER SHAKY
September 17. The watchdog group's report, part one of 'The Coming AI Waste Wave,' counts the whole data center, not just servers. Its model of a 100 megawatt site comes to about 70,000 metric tons of equipment per gigawatt: cooling 35 percent, power distribution 34, backup power 15, servers and accelerators 13, networking 3. It says earlier studies missed 87 percent of that. On a 2.5 to 5 year replacement cycle it projects 31 to 46 million tons of AI-related e-waste a year by 2050, out of 196 to 211 million total, and 40 to 60 times prior estimates by 2030. Analyst Frank Dickson: the 40 to 60 times figure 'is the least defensible part of this report.' Another reviewer notes retired gear is not always waste. The report asks for lifecycle disclosure and take-back programs. Why it matters: the number will show up in your next data center hearing, so know where it came from.
SERVERFARM'S CREDIT LINE GROWS TO $3.895 BILLION FOR HOUSTON, ARKANSAS AND ATLANTA CAMPUSES
September 17. The Manulife-backed developer added $895 million to its revolving credit facility, which now totals $3.895 billion. 22 banks and one institutional lender are in the syndicate. The money funds new builds and retrofits in Houston, Clarksville in Arkansas, and Atlanta. Why it matters: another week, another billion-scale line for hyperscale campuses, and the banks are still saying yes.
APPLE EYES A 2029 RETURN TO SERVERS, WITH TWO OR FOUR M8 ULTRAS AND NVIDIA'S NVLINK INSIDE
September 17, citing The Information. Apple is working on an AI server built on its own chips: an entry model with two M8 Ultra processors and a bigger one with four. It has discussed using Nvidia's NVLink Fusion to connect them. The target buyers are AI developers, businesses and governments that want to run models on their own gear. Launch is not expected before 2029. Nothing is final and the project could still be canceled. Apple left this market when it killed the Xserve in 2011. The report says OpenAI and Anthropic have been buying large numbers of Macs for AI work. Why it matters: a Mac-chip server would be the first real on-prem option that is not Nvidia or AMD.
D-ROBOTICS RAISES $400 MILLION SERIES C FOR ROBOT CHIPS
September 17. The Shenzhen company makes the computing chips and software stack inside robots. Mirae Asset led, with Meituan and Hefei state capital in the round. The same day's list also has Health Force, a Dutch startup with a 4.2 million euro seed round for AI agents that do hospital prior authorizations and insurance paperwork. Why it matters: the physical AI money is flowing to the chips inside the robot, not just the robot.
SNAP LAUNCHES SPECS INTELLIGENCE ON IPHONE AND MAC; CELLULAR GLASSES BUNDLE IS $2,395
September 16. Specs Intelligence is an assistant that learns your goals and routines from the apps you connect, then surfaces things before you ask. It is on iPhone and Mac now through a waitlist at specs.com/intelligence, no glasses required. The Specs glasses get a 5G carrying case for cellular use: $2,395 bundled, or $200 for the case alone, plus $10 a month for Verizon customers or $20 for everyone else. Orange in France and EE in the UK are the other carriers. Ships in fall 2026, preorders open with a $200 refundable deposit. Why it matters: Snap is selling the assistant separately from the hardware, which is a bet that the habit matters more than the glasses.
OPENAI AND AARP'S OATS TAKE FREE CHATGPT WORKSHOPS TO 1,000 OLDER ADULTS IN 10 CITIES
September 16. The program is called the Older Adults AI Skills Jam, run with AARP's Older Adults Technology Services. In-person sessions in Denver, Miami, San Antonio, Montgomery County in Maryland, Queens, St. Louis, the Twin Cities, Nashville, Fresno and Boise. A big part of the curriculum is spotting scams: urgent language, demands for secrecy, odd links. OpenAI's scams lead Jack Stubbs said older users are a smaller share of ChatGPT partly because the user base skews young. Why it matters: if your parents ask about AI, this is a free, in-person place to send them.

🤖 Trending Models · Hugging Face

deepseek-ai/DeepSeek-V4.1-Flash
image-text-to-text · ★3.1K · 429.9K dl
prism-ml/Ternary-Bonsai-2-27B-gguf
text-generation · ★734 · 405.6K dl
Qwen/Qwen3.8-27B
image-text-to-text · ★15.6K · 7.4M dl
m-a-p/YuE2-3B
text-to-audio · ★778 · 13.7K dl
TokenRhythm/NeoHorse-1-4B
text-generation · ★2.4K · 22.7K dl

📈 Markets

NVDA 219.34 ▲2.5%
MSFT 497.75 ▲1.5%
GOOGL 347.33 ▲1.3%
AMZN 251.19 ▲2.1%
META 682.31 ▲1.3%
AMD 545.09 ▲6.4%
AVGO 347.30 ▲2.3%
PLTR 176.24 ▲1.1%
SPCX 154.81 ▲2.6%
TSLA 366.20 ▲2.3%

The BriefOn September 17 the security firm AIR published Plugin4Shell. It is a zero-click flaw in the plugin systems of Claude Code, Codex, GitHub Copilot and Gemini CLI. Zero-click means you do not have to do anything wrong. The agents pin a plugin to a commit hash, but they never check that the checkout landed on that hash. An attacker who controls a plugin repo on Bitbucket or a self-hosted git server can name a branch with the pinned hash, and git picks the branch over the commit. Claude Code fixed it in 2.1.179 and Codex in 0.146.0. Copilot has no fix yet. Google says Gemini CLI is deprecated and will not get one. If you use plugins from a marketplace that is not on GitHub, check your agent version today.

Level UpSpend 15 minutes on your own coding agents. One: run claude --version and codex --version. You want 2.1.179 or newer for Claude Code and 0.146.0 or newer for Codex. Two: in Claude Code run /plugin marketplace list and read the source of each marketplace. GitHub-hosted ones are safe from this trick because GitHub refuses branch names that look like hashes. Any marketplace on Bitbucket, GitLab or your own git server is the one to look at. Three: open /plugin, go to Marketplaces, and see which of those have auto-update turned on. The docs say third-party marketplaces are off by default, so if one is on, somebody turned it on. Four: if your team uses Copilot with plugins from a non-GitHub marketplace, turn auto-update off until Microsoft ships a fix. Five: if anyone still runs Gemini CLI, move them. Google is not patching it. The Claude Code docs page below is where the marketplace and auto-update settings are explained. →Claude Code docs: marketplaces, sources and the auto-update switch