Daily Brief SecondSource Morning Brief · September 22, 2026 · Sep 22, 2026
1. In one day, three researchers went from OpenAI's help forum into its internal codebase, and only a newer model got them through the last step. (Affects: CISOs)
2. Former OpenAI board member Helen Toner: race so fast that your security can't hold, and "beating China" doesn't happen. (Affects: heads of AI policy)
3. An open letter sets out five minimum requirements for outside evaluators, and METR, the evaluator most often named, says its own work still runs on a voluntary basis. (Affects: anyone assessing a lab's safety commitments)
This issue draws mainly on our September 22 research brief, plus social-platform material from September 11–18 that we caught up on; the events run from July 25 to September 18. We swept 346 pieces overnight, and this issue uses 28 outside receipts with links you can check. This is the email edition; the full edition of this issue is the archive of record.
Why this matters to you: what got breached was a forum and single sign-on, and neither one usually shows up in the security section of your vendor questionnaire.
On September 18 The Wall Street Journal reported an incident from two months earlier, and the attackers — Hacktron AI, which sells AI security products — published their full technical write-up the same day. On July 25, three of its researchers went from OpenAI's public help forum, community.openai.com, all the way into OpenAI's internal codebase, and opened a harmless pull request there (#1186742) as proof they could get in (Hacktron AI, 2026-09-18 / disclosure thread).
The chain had two links. First, the forum runs Discourse, a widely used open-source forum package. The researchers uploaded a crafted image that tripped up the image-parsing library underneath it, and got code execution on the forum server. At that point they held one forum server and nothing more. The second link did the damage: OpenAI's own single sign-on was misconfigured. Big companies usually give employees one account for every internal system. When that setup is wrong, taking over one small system that can touch login state can hand you the keys to all the others. Here, the misconfiguration let the attackers turn a login session on the compromised forum into a takeover of the ChatGPT and Codex accounts of active forum members — OpenAI employees among them — without anyone clicking anything. From there, the third-party services those accounts were already linked to gave the attackers a path into Outlook, Slack and GitHub.
The part to remember is the model generation. By the attackers' own account, Anthropic's Claude Opus 4.8 found the image-parsing bug and wrote part of the exploit, but couldn't produce a version that worked reliably. Anthropic's next model, Opus 5, shipped on the evening of July 24. They switched to it the next day, and within hours it closed that last step. Same people, same bug; the model in their hands was one generation newer.
Verification: the technical detail of the attack has exactly one primary source, the attackers' own write-up, which is also a marketing asset for them. Four parts of the skeleton can be checked from outside: the dates, the pull-request number, the time to fix and the bounty. We checked all four, and OpenAI has said publicly that the problems are fixed (TechCrunch, 2026-09-18 / Fortune, 2026-09-18). The attackers' own timeline puts about fourteen hours between their report and OpenAI's confirmed fix, with a $6,500 bounty; the Discourse side shipped its patch on July 27. Status as of this issue: both bugs are patched. This is not an ongoing incident. ⚠️ Two things lack evidence. One: the Journal's sources said the codebase holds "OpenAI's algorithmic secrets." That is the sources' description. OpenAI hasn't said it, and the attackers say they didn't read sensitive code. There is no evidence that model weights or algorithms left the building. Two: the story that Opus 4.8 couldn't do it has no third-party check, and it comes from a company with a motive to make the job sound harder.
Judgment update: today we log a judgment we haven't settled yet. Attackers' capability jumps each time a frontier model ships (the newest models from top labs such as OpenAI and Anthropic), and defenders' peripheral systems don't jump with it. So a defender's lead doesn't build up with security spending; it gets reset on the day each frontier model is released. ⚠️ Right now it rests on a single case. Its two load-bearing legs are that it took a new model generation to finish the job, and that the way in was exactly where the defender had invested least. Both come from the same attacker write-up, so they can't corroborate each other.
Investor note: the market frames security risk at frontier labs as a question of whether the model weights hold. This evidence says what gave way was a forum and single sign-on: building a full chain into the internal codebase took one day this time, and the bounty paid for it was $6,500. A bounty is what a bug-bounty program pays, not the value of the assets reached, so don't read one as a measure of the other. The direction weakens that framing, on a sample of one.
What would prove this wrong: we're setting our own window. If ninety days pass after the next frontier model release with no public attack case of the "old model couldn't, new model could" kind, this judgment is wrong. Or, if Hacktron's account is overturned and it turns out Opus 4.8 could do it after all, the only evidence leg breaks.
Why this matters to you: the slow-down debate shifts from "should we slow down" to "can your security keep up with the speed you picked," and the second question can be measured.
Read this alongside item 1. On September 18, Helen Toner of Georgetown's Center for Security and Emerging Technology (CSET), a former OpenAI board member, went after the argument that we must beat China and therefore have to rush ahead as fast as possible: "If you rush so much that your security is garbage and your increasingly advanced AI models are there for the taking by Chinese hackers, then you have uhhh not succeeded at making sure we have better AI than China" (Helen Toner, 2026-09-18). The argument uses the other side's own goal against its method, so you can test it without sharing her position.
She added two clarifications that day, and they carry very different weight (Helen Toner follow-up, 2026-09-18). In one, she says the three researchers are not total amateurs, but "if they can do this in 72 hours, it bodes very poorly for what a more resourced effort could manage." That extrapolates from something that already happened, and not very far. In the other, she says that "even if your security is very good, it's unlikely to stand up to a high-priority state-backed cyber op." That one has no data behind it, and we have no numbers to support or refute it either.
Verification: we have direct links to the original posts, and her same-day thread confirms the wording. ⚠️ She drew her own boundary: "I would guess the hack as described here would not have gotten them access to model weights, but we don't know." So the evidence under her argument reaches only as far as what item 1 established, forum login state being turned into employee accounts. "The models will be taken" is her inference. She has long argued publicly for a cautious path, and this argument points the same way as her position.
Judgment update: our September 15 issue wrote that nobody had put a speed number on "pacing the frontier," the proposal from Anthropic CEO Dario Amodei to slow the rate at which AI capabilities advance, and that the only thing outsiders could verify was whether evaluators got in. Every reaction we've read since has fallen on one axis: who evaluates, on what terms, and whether it amounts to regulatory capture. Toner's post is the first argument we've seen that starts from whether the security itself is feasible. It collides head-on with two views we're writing up for the first time today, and we're keeping the conflict open rather than picking a side. Dean Ball, who does policy work at OpenAI, argues that pacing actually makes open-weight models more competitive, so labs are not afraid of open source (Dean Ball, 2026-09-12). Graham Neubig, an associate professor at Carnegie Mellon, questions the cyberattack threat model, one premise being that frontier models are expensive and their weights are controlled (Graham Neubig, 2026-09-12). ⚠️ Strictly speaking, the case in item 1 doesn't refute Neubig: there's no evidence the weights were reachable, so we log it as pressure on his view, not a refutation. All three are really arguing over one measurable thing: the rate and severity of security incidents at frontier labs. Our sample size is one.
Investor note: the market prices "slowing down" as a discount on growth. Item 1 suggests speed and security aren't a simple trade-off: when security fails, the lead that speed bought leaks away. It weakens the premise that racing as fast as possible guarantees beating China, but a single case is holding it up.
What would prove this wrong: a frontier lab publishes its security spending and incident record, and the record shows no rise in incidents during full-speed releases. Or a case surfaces where frontier model weights really do leak, at which point Neubig's premise is refuted and Toner's inference has evidence behind it.
Why this matters to you: when you assess a lab's safety commitments, you now have a checklist you can tick off line by line.
On September 18, an evaluators' group called the AI Evaluator Forum launched an open letter setting five minimum requirements for "embedded" third-party evaluators. Embedded evaluators were the first proposal in Amodei's pacing essay: frontier companies let outside evaluation teams work inside with employee-like access. The five: ① evaluators are independent, not owned by the frontier company, and paid in no way tied to their findings; ② there are several of them, each free to disagree in public; ③ their NDAs are narrow and their redactions expire; ④ they're protected from retaliation — including legal protection and contract renewal — even when their findings are unflattering; ⑤ they get access equal to highly privileged employees, physical spaces included (Arvind Narayanan, Princeton computer science professor and one of the signatories, 2026-09-18).
The reading on where things stand today came two days earlier. METR is the independent AI model evaluator named most often. Its president, Chris Painter, responding to attacks on September 16, said METR is funded by donations and takes no money from frontier AI companies or their employees, though it does accept free model access. Working with a third-party evaluator today is "entirely voluntary," he wrote. "This often involves NDAs and redactions," he added, and he said METR's own reports are not "adequate as oversight" (Chris Painter, 2026-09-16). On the other side, Dean Ball defended METR against the attacks while arguing it shouldn't be crowned the only evaluator (Dean Ball, 2026-09-13). So "there should be several" is already common ground. The real fight is over money, redactions and retaliation.
Verification: the letter is its organizers' own account. The "100+ signatories" figure is the reposter's description, and we don't have the signatory list. ⚠️ The letter says there are already "early adopters" but names none; as of September 16, no AI company had signed on to the standard. Painter's post is the organization describing itself, with no donors or amounts disclosed. "METR today falls short of the five" is our reading from setting the two documents side by side; neither one says it.
Judgment update: our September 15 issue said the only thing outsiders could verify in a pacing commitment was whether evaluators get in. What's new today is that "getting in" has been broken into five conditions you can check one by one, and the evaluator named most often, on its own account, still falls short on at least one of them, NDAs and redactions. The one leg of pacing that can be verified got an acceptance standard today for the first time.
Investor note: the market reads an outside evaluation team working inside a lab as a sign the risk is handled. Until any company signs the standard, what that sign means depends on contract terms, and those terms aren't public — which weakens that assumption.
What would prove this wrong: a frontier company publicly signs all five and discloses the NDA and redaction expiry terms in its contracts, in which case we retract the reading that the sign depends on undisclosed terms. Or METR or another evaluator that gets named explains publicly that its current arrangements already meet all five, in which case our reading that at least the NDA-and-redaction condition isn't met is wrong.
What to take away today: we're setting our own window — if ninety days pass after the next frontier model release with no public attack case of the "old model couldn't, new model could" kind, the attacker-reset judgment is wrong. And until any company signs the evaluator standard, what an embedded evaluator signals depends on contract terms that aren't public.
1. [This week] (event dated September 14) Dan Selsam, a current OpenAI researcher, said through a statement posted by former OpenAI employee Daniel Kokotajlo that today's alignment evidence may no longer be trustworthy. His colleague Lucas Beyer countered that models "noticing they're being evaluated" mostly comes from strings written into their training environments. ⚠️ Neither side showed data. ⇒ The step that would settle it is cheap: measure how common those strings are. (Kokotajlo post / Beyer)
2. [This week] (event dated September 17) Sakana AI CEO David Ha said "pacing the frontier" looks more like regulatory capture: if you think a model is too dangerous, don't release it — no new rules against open source needed. ⚠️ His company had announced an enterprise-sales expansion the day before, so the argument points the same way as his commercial position. (David Ha / expansion announcement)
3. [This week] (event dated September 18) Eric Topol of Scripps Research pulled together three pieces — in the Financial Times, Nature Medicine and The New York Times — published within five days of each other, each saying medical AI is being deployed ahead of the evidence. ⚠️ We haven't read any of the three. ⇒ Approval to market is not proof that it works. (Eric Topol)
4. [This week] (event dated September 18) Theo, a video creator in the developer world, said the biggest cost for agents (AI programs that run multi-step tasks on their own) is cache writes: edit the middle of a conversation history and everything after it has to be rewritten, so deleting costs more than keeping. ⚠️ "Over 60%" is his personal observation. ⇒ When you compress a conversation, check first that you're only appending at the end. (Theo)
5. [This week] (event dated September 17) Research firm SemiAnalysis claims agent traffic is now more than 70% of all inference traffic. ⚠️ Whose traffic, in what unit, and what counts as an "agent" are all undefined, and we don't have the underlying report. (SemiAnalysis)
1. [This month] (posted September 11) Compress a model's working memory and the high-bandwidth memory you save gets filled back up by more simultaneous conversations. The argument is now about where demand moves, not whether it disappears. Our September 21 issue carried SemiAnalysis's reading that capacity demand and bandwidth demand for high-bandwidth memory are splitting apart. What's new today is two anonymous analyst accounts drawing opposite conclusions from the same thing. First, one definition: in a long conversation, a model has to keep the computed results for everything said earlier, and that store is called the KV cache. It lives in high-bandwidth memory next to the GPU. The anonymous hardware-analysis account @HiCagr argues that Chinese AI lab DeepSeek's new open model V4.1 Flash squeezes the KV cache to about 890 bytes per token, an eighth of the previous generation's standing footprint. But the memory each conversation frees gets filled by four times as many simultaneous conversations, so bandwidth needed per GB goes up, not down, and value moves toward the logic die at the bottom of the memory stack (@HiCagr, 2026-09-11). The anonymous Chinese AI watcher @teortaxesTex replied that what fills memory back up is swarms of agents, and estimated that 64 agents running at once would exceed the previous generation's usage (@teortaxesTex, 2026-09-11). ⚠️ Both sets of numbers are relayed without a derivation, and are missing context length, overlap and cache hit rate; the claim that the logic die costs three to four times an ordinary memory die has no source. ⇒ For anyone watching the memory cycle, look at which spec moves first: if bandwidth specs move first, the first reading is right; if purchase volumes move first, the second is. For anyone building agent products, if these two accounts are right, the number of simultaneous conversations is itself a driver of memory cost, on top of conversation length.
2. [Evidence update] (checked September 22) The size of the "initial purchase commitment" behind Qualcomm's warrant to Amazon hasn't appeared in any filing yet, and the earliest it could is early November. Our September 9 issue covered the deal: warrants for up to 25 million shares, tied to up to $60 billion of Amazon server-chip purchases, with 3.75 million shares vested at signing. At the time we declined to use the extrapolation that 15% applied back to $60 billion implies an initial commitment of about $9 billion, and we wrote down that one condition for overturning that call would be disclosure of the commitment made at signing (Qualcomm 8-K, 2026-09-08). What's new today is when that condition could resolve. We checked the SEC's filing system: Qualcomm filed its latest periodic report on July 29, and that report covers the quarter that ended in late June, before the September 8 announcement (EDGAR, Qualcomm filings). Qualcomm's fiscal year ends in late September, so the first filing that could disclose the figure is its annual report, which by past pattern lands in early November; Amazon's third-quarter report comes around late October. ⇒ The number can't be found because the document doesn't exist yet, and no other channel will turn it up. If your model carries that roughly $9 billion, it is still an assumption, not a fact.
1. [This week] (posted September 16) Princeton professor Arvind Narayanan says the most underrated AI harm is the "AI flood": faking genuine interest has become effortless, and the cold-email channel is dead. His example is his own inbox. With the next graduate-admissions cycle still months away, he has already had about 75 inquiries, and that's just one of what he counts as 50-plus kinds of affected channels. Nobody talks about it, he says, because the harm is spread across dozens of channels instead of landing as vividly as a hack: "it registers as 50 different problems instead of one huge problem" (Arvind Narayanan, 2026-09-16). Dean Ball, who does policy work at OpenAI, said on September 12 that several agents with no visible person behind them had pitched him paid gig work (Dean Ball, 2026-09-12). ⚠️ Both are inbox anecdotes with no population behind them; the 75 is an example, nothing more. We haven't tracked this thread before and are opening it today: the first side effect of cheap agents may be that open channels stop filtering anything. ⇒ For organizations that still take in mail through a public inbox or a public application form, the question is what it costs to verify who's on the other end. Adding a content filter won't solve it.
No major new papers this week. We haven't finished the 164 papers we pulled in overnight, and the academic abstracts held no same-day paper news; we don't dress up evergreen concepts as news. The item below fills the column from the past month and carries its original date.
1. [This month] (posted September 11) Same model, different harness: scores on a science-task benchmark went from 3 to 11. On another leaderboard, first place rests on 4 of 1,270 questions. The harness is the layer of code around a model that actually reads files and runs commands; our September 21 issue introduced it. The anonymous Chinese AI watcher @teortaxesTex posted that on Terminal-Bench-Science, a benchmark for agents completing science tasks in a terminal, DeepSeek V4.1 solved 3 of 70 tasks with the Terminus 2 harness and 11 with OpenAI's Codex harness (@teortaxesTex, 2026-09-11). He also pointed out that V4.1 ranks first on the agentic-coding subcategory of the public leaderboard LiveBench, and that the ranking rests on 4 Python questions out of 1,270 (@teortaxesTex, 2026-09-11). ⚠️ Both come from the same anonymous account on the same day, the 11-task run has no screenshot, and nothing was controlled, so treat the jump from 3 to 11 as an upper bound. He's a DeepSeek fan who debunked a ranking that flatters DeepSeek, which eases the worry about motivated bias. ⇒ If you choose models based on leaderboard rankings, read the rank together with the harness and the number of questions in the subcategory; when neither is disclosed, the cheapest check is to rerun it in your own harness.
1. [This week] (launched September 15) Jev, a model that only makes "decisions," launched with output tokens free, splitting its pricing off from generation. Diogo Almeida, who describes himself as one of ChatGPT's co-inventors, released Jev as a decision model for workflow gates such as classification and routing. He says it is 20 to 200 times faster and 40 to 400 times cheaper than a comparison group, and output tokens are free (Diogo Almeida, 2026-09-15). Armin Ronacher, the creator of Flask who is now building agent products, tried it on September 17: "I'm really impressed," he wrote, adding "I bet we will see some fast followers" (Armin Ronacher, 2026-09-17). ⚠️ Both multiples are self-reported, with no defined comparison, metric or price list, and no third-party evaluation; we haven't verified Almeida's co-inventor claim; Ronacher's trial came with no measurements. ⇒ For teams doing heavy classification and routing inside agent workflows, the pricing shape is the thing to note: the gate that makes decisions and the generator that writes content can be priced, and bought, separately.
No archive pick this issue. The older material we could use has run out.
The past 24 hours. 346 new pieces came in overnight: 164 papers, 126 social-platform posts, 41 blog posts, 10 subscription newsletters, 4 technical reports and 1 paid analysis. We haven't finished reading any of those 346 today. The social-platform posts cited in the body were all posted between September 11 and 18 and are older material we caught up on. For main-line item 1 we also went directly to the primary sources — the attackers' full technical write-up and two media reports — and for chips item 2 we checked the SEC's filing system directly.
One-time backfill. Older material going back to early July was also filled in overnight. None of it is news from the past 24 hours: 4,947 pieces in all, mostly papers, newsletters and company filings, not counted in the 346 above, and none of it made it into today's body.
A note on source concentration. ⚠️ Nearly all the receipts in today's body are social-platform posts; not one of the newsletters or blog posts among the 346 above made it into the body today. Model watch and chips item 1 each lean on the same anonymous account for one side, and both items say so.
What you are not getting today. The one that most affects judgment comes first: the Wall Street Journal original is behind a paywall, so we read the downstream coverage in TechCrunch and Fortune, and OpenAI has not issued a full statement on the record. The other two: we don't have the open letter's signatory list, and we haven't read the source documents for any of the five unverified items.
The sources we track. Our long-term roster has 529 named sources: 302 on social platforms, 90 shows, 51 news outlets, 48 blogs, 48 paper authors and 46 newsletters, with the rest spread across earnings, keynotes and other channels.
⚠️ Last night we actually checked 374 social-platform accounts, with another 14 unreachable or dead. The 374 is accounts actually checked last night; the 302 above is social-platform people on the long-term roster, and the two count different populations. The "126 social-platform posts" above counts pieces, not accounts.
Representative names: on social platforms, Helen Toner, Arvind Narayanan, Dean Ball, Aaron Levie, Eric Topol and David Ha; in newsletters, Zvi Mowshowitz, Nathan Lambert and Jack Clark; among research firms, SemiAnalysis. This issue uses 28 outside sources in the body, the same figure as the sourcing line up top and the footer, counting only links the body actually cites that are not on our own domain.
This is not a news digest: we hunt each day's AI firehose for the insights that actually matter and the practitioner judgments worth tracking over time, and we show how every item was verified — the point is always "which judgment got harder, and who's been right," never "what happened today."
— SecondSource · generated by our research system · 28 sources · Got a view? Reply and tell us
Written from the same research and judgments as the Traditional Chinese edition; every claim links to a primary document. Read the full edition.