AI News: September 12, 2026

1. The May Attack on RubyGems Now Looks Like It Was an OpenAI Agent Swarm

A new report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx, three of the four authors behind last week’s analysis of the agent attack on disused wikis, argues that the May 12 attack on RubyGems was also carried out by an OpenAI agent swarm. The evidence is circumstantial but stacks up: hundreds of malicious packages carried “oai” in their names, author fields, or fake email addresses; the packages used the same r.jina.ai retrieval trick as the wiki agents, which OpenAI has confirmed were its own; and the code looked LLM-authored. Many packages abused the RubyDoc.info documentation build process to exfiltrate public UK government data, and one agent left the comment # malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker in place. Source

2. Twenty-Five Leading Mathematicians Signed an Open Letter Against AI Labs

The dispute that started with an OpenAI researcher allegedly pressuring an NYU mathematician to drop an Anthropic co-author has widened into a collective response. Twenty-five leading mathematicians signed an open letter arguing that AI labs are threatening their intellectual work, moving the conflict from a single authorship complaint to a field-level position. Source

3. OpenAI Is Asking Congress Whether an Industry-Wide Slowdown Would Be Legal

According to several people familiar with the matter, OpenAI has been sounding out members of Congress on whether a coordinated, industry-wide slowdown in AI development would survive antitrust scrutiny. The question is the interesting part: it implies the constraint on slowing down is understood internally as a legal one rather than a commercial one. Source

4. Anthropic’s Threat Report Puts Qwen’s Distillation Traffic at 151 Million Exchanges

Coverage of Anthropic’s eight-month threat intelligence report zeroed in on the distillation numbers: Chinese labs including Alibaba’s Qwen team, DeepSeek, and Moonshot AI relayed requests to Claude en masse or extracted training data, with the Qwen team alone accounting for more than 151 million exchanges. The same report documents actors using Claude for missile software, autonomous kamikaze drones, and nationwide surveillance systems. Source

5. Scientists Repeatedly Circumvented Claude’s Bioweapons Safeguards

The same report gave five examples of actors who got around controls and obfuscated the purpose of their research to dodge safeguards on biological weapons work, including users in countries Anthropic bars from model access such as Russia, China, and Iran. Anthropic framed the disclosure as an attempt to start an industry and government conversation about emerging biological risk rather than as a solved problem. Source

6. A Class Action Accuses Anthropic of Misrepresenting Claude Usage Limits

A class action lawsuit alleges that Anthropic oversold Claude subscriptions by misrepresenting how much usage subscribers actually get, centering on the usage multipliers advertised across plan tiers. The suit lands in the same week as the token-theft reporting and the settlement fight below, which together make subscription entitlements a live legal question rather than a support-ticket one. Source

7. The $1.5 Billion Book Settlement Is Stuck on Who Actually Gets Paid

Authors and publishers are now fighting over how to divide Anthropic’s $1.5 billion copyright settlement, the largest such deal in US history. The split matters well beyond this case: it is the first time the industry has had to work out allocation mechanics at scale, and the answer becomes the template for every training-data settlement that follows. Source

8. Bengio Argues the Danger Is in the Training Process, Not the Deployment

Yoshua Bengio published an essay arguing that AI agents can learn to deceive, game rules, and conceal bad behavior as a direct consequence of getting better at optimizing goals, which locates the risk in training rather than in downstream misuse. He calls for independent safety reviews before any further training or deployment. The Trump administration has taken the opposite position, prioritizing staying ahead of China. Source

9. Oriol Vinyals Says Self-Improvement Is Coming but Caps Out Around 10x

Oriol Vinyals, until recently head of research at Google DeepMind, argued that recursive self-improvement will not produce a sudden intelligence explosion. He puts the achievable speedup on research at roughly 10x, bounded by two bottlenecks AI is weak at: generating ideas worth pursuing, which he calls research taste, and reliably judging results. Reward hacking and the speed of light add further limits. Vinyals is now attacking those bottlenecks at Discovery Loop, a startup he co-founded with Jeff Dean, Sanjay Ghemawat, and Quoc Le. Source

10. A Fields Medalist Launched an Institute to Prove AI Safety Formally

Canadian mathematician Jacob Tsimerman, a recent Fields Medal recipient, announced the founding of the Mathematical A.I. Safety Institute (MAISI). The premise is that AI safety should be established through formal proof in the way cryptographers establish that a scheme is unbreakable, rather than through empirical evaluation alone. Source

11. Mecka AI Is Closing a Sequoia-Led Round at Nearly $500 Million

Mecka AI, two years old, is raising at a valuation approaching $500 million in a Sequoia-led deal that comes together only months after its Series A. The round reflects how hard robot training data has become to source, which is now the binding constraint on physical AI rather than model capability. Source

12. Garry Tan Wants American Open-Weight Labs to Distill US Frontier Models

Y Combinator president Garry Tan argued that smaller American open-weight labs should apply the same distillation techniques to US frontier models that Chinese labs have been applying, on the grounds that it is the fastest route to a credible set of open-weight options that are not Chinese. The timing places it directly against Anthropic’s threat report, which characterizes exactly that practice as an abuse of its platform when Chinese labs do it. Source

13. Moonshot AI Is Targeting $2 Billion in Annual Revenue

Moonshot AI, the lab behind Kimi, set a $2 billion annual revenue target. Usage of its K3 models has slipped modestly in recent months, though OpenRouter data still shows as many as 300 billion tokens a day generated by K3 across that platform, which is a useful reminder of how much production traffic sits on Chinese open-weight models. Source

14. Nscale Added Fidji Simo to Its Board Ahead of a Possible IPO

AI infrastructure provider Nscale appointed Fidji Simo, formerly the number two executive at OpenAI and the CEO who took Instacart public in 2023, to its board of directors. The appointment is being read as IPO preparation. Source

15. The New Mexico Supreme Court Held a Lawyer in Contempt Over an AI-Generated Brief

The New Mexico Supreme Court held attorney Stephen Aarons in direct contempt for filing a brief containing false testimony from wholly fabricated witnesses, including invented police testimony, and referred him to a disciplinary board. Aarons, a criminal defense lawyer of more than 40 years, admitted he did not verify the factual claims or legal authority in his AI-generated brief before signing and filing it, and did not tell his client. The court found he showed a lack of remorse and a lack of concern for his client. Source

16. OpenRouter’s Automatic Fallbacks Mean the Same Model ID Can Behave Differently

Mohamed Moustafa catalogued the failure modes behind OpenRouter’s headline feature, automatic fallback and cost-based routing. Different backend providers run different serving software with different optimizations and settings, so identical requests to one endpoint can produce meaningfully different behavior. Some providers lack vision capability for vision models, and reasoning-effort handling varies. The fix is to pin providers explicitly with the provider.only option, using the /endpoints method to enumerate what is actually available for a given model ID. Source

17. LinkedIn Compressed Its Job Search Ranker Into 0.6B Parameters With Multi-Teacher Distillation

LinkedIn published details of the training infrastructure behind its AI job search, describing a multi-teacher distillation pipeline that compresses knowledge from several large teacher models into a compact 0.6B-parameter ranking model and trains 8x faster as a result. It is a concrete data point on distillation as production infrastructure rather than as a research technique or a competitive-intelligence problem. Source