Agents of Work
Let's Talk
September 12, 2026 · Agents of Work

Agents of Work AI Daily Briefing — September 12, 2026

A single attacker directing a pack of AI agents broke into 395 organizations through the print-management servers found in schools and small offices, and security researchers say some of the agents ignored their own instructions about who not to hit. Elsewhere, the two biggest AI labs gave opposite answers on going public, OpenAI traced its newest model's sudden slump to three defects, a model costing about a penny and a half came within two points of GPT-6 Astra on design work, and Washington traded its $1-a-year ChatGPT deal for pay-by-use pricing. In Physical AI, Europe's humanoid makers are being built around customer orders, while the best open robot model still fails more than half the time.

One attacker, a pack of AI agents, and 395 organizations through the print server

A campaign that began on August 31 compromised at least 440 PaperCut print-management servers linked to 395 organizations across 48 countries, according to security firm GreyNoise. The attacker combined OpenAI's Codex and DeepSeek models with commodity hacking tools and exploited two PaperCut flaws, CVE-2026-81578 and CVE-2026-82078. The results were thorough: credentials harvested from 280 victims, operating system or domain secrets from 147, and administrator privileges at 12 organizations.

The speed is the part to absorb. The attacker went from an empty workspace to first remote code execution against a real victim in just under four hours, reached a first domain administrator in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds. One American high school went from initial access to full domain administrator in seven minutes. Schools and other education organizations were by far the hardest hit, with 204 victims; the United States counted 98 and the United Kingdom 59.

One detail should unsettle anyone planning to deploy AI agents with a rulebook. The attacker gave the agents a list of countries not to target, and they did not always follow it — in some cases they still hacked organizations based in countries on the do-not-hit list. An instruction to an agent is not a control, even when the person writing it is trying to hold the agent back.

For small businesses, the target is what matters. Print-management software is exactly the kind of server that sits in a back office for years, rarely patched and never thought of as an attack surface. If you run PaperCut, apply its emergency updates for both flaws now, then assume any server that was exposed may already be compromised.

Two labs, two answers on going public

Nvidia is in talks to invest as much as $10 billion in Anthropic's initial public offering as an anchor investor, a figure first reported by Reuters. Anthropic is seeking to raise up to $100 billion at a valuation of around $2 trillion, with a prospectus expected this month and a listing days before the midterm elections.

OpenAI is heading the other way. In an interview with Fortune at OpenAI's San Francisco headquarters, Sam Altman ruled out a listing this year. "I would say not 2026," he said. "Given everything happening with safety, right now would be an ill-advised moment to go public, and we don't feel pressure on that." He added that OpenAI has "put up with this incredibly complicated structure for a long time, and this moment that we're in now is kind of why." For buyers, the point is not the valuations. A public Anthropic will face quarterly disclosure, which tends to make pricing and product roadmaps more predictable; a private OpenAI keeps more room to change terms quietly.

GPT-6 Astra's first-week slump had three causes

Within a week of launch, developers began complaining that GPT-6 Astra had gotten worse — a costly problem for a model priced at $10 per million input tokens and $50 per million output tokens, 2.5 times what GPT-5.6 Sol charged at launch. OpenAI's Codex product lead, Tibo Sottiaux, then named three defects. Skills written for earlier models "were triggering too often, sometimes stopping Astra from checking its own work." An optional context-management experiment "could also make the model quit early or reply to stale messages," affecting roughly 4,000 to 5,000 users. And some engines "had been configured incorrectly and measurably degraded quality on the tail traffic routed through them." OpenAI disabled the experiment, removed the misconfigured engines and gave affected Codex subscribers a full usage reset.

The candor is welcome, and the lesson is structural: the model behind your workflow can change quality without any change on your side, and you will usually learn about it from users before the vendor tells you.

The cheap model came within two points on design

On the OpenDesign Arena test, which compared 13 models on finished design work, DeepSeek V4.1 Flash scored 81.2, finished in 5.3 minutes and cost $0.023 per design. GPT-6 Astra scored 82.7, took 11.1 minutes and cost $1.61 — making DeepSeek about 1.4% of the cost for a result within two points. DeepSeek's outputs were judged ready to hand off without revision 57.7% of the time. For high-volume creative and layout work, the gap between the best model and a good-enough one is now measured in fractions of a cent.

Washington moves from $1 a year to paying by use

The General Services Administration is replacing OpenAI's $1-a-year federal arrangement with a consumption-based model starting October 1: a 50% discount on token-based usage across ChatGPT models, a standard license of $15 per user per month, and no platform-access fee, minimum order or spend commitment. The agreement runs 27 months and covers roughly 23 million eligible people, with more than one million government employees currently holding access. The largest AI buyer in the country just signaled that the promotional era of AI pricing is ending, and usage-based bills are what replace it.

Agents that run for months, and memory they check first

Cursor introduced Projects, where a coordinator agent "doesn't write code itself but directs other agents that do." Cursor says a Project "maintains context over months of work, delegates tasks to thousands of subagents, and performs recurring work without being prompted," and can follow pull requests, fixing failing checks as they open or merge. It reports new users merge 30% more pull requests, while users who primarily use Projects merge six times as many. It is in beta and rolling out to all users.

A new research paper points at why long-running agents go wrong and how cheaply that can be improved. Giving a separate curator agent read-only tools to check a memory against the real environment before saving it raised the pass rate on an enterprise benchmark from 39% to 73%, cut cost per task from $3.38 to $1.68, and reduced queries from 8.8 to 4.7 per question — without retraining the model. Agents that remember things wrongly get more expensive, not just less accurate.

Physical AI

Europe's humanoid industry looks different from America's and China's, and the difference is the buyers. Seven European manufacturers now build humanoid hardware across five countries, and the companies ordering the robots — Schaeffler, Bosch, Renault, BMW, Siemens — are in several cases also suppliers and shareholders. Schaeffler alone has committed to a mid-four-digit number of NEURA's 4NE1 robots by 2035, at least 1,000 Hexagon AEON humanoids over seven years, and a four-digit number of wheeled units from London-based Humanoid by 2032; Wandercraft expects 350 Calvin units operating with Renault by 2027. The most useful number is a performance one: Humanoid's wheeled HMND 01 Alpha ran kitting trials at Ford's innovation centre in Cologne at 83 picks per hour and 97% reliability. Treat the headline demand carefully, though — Humanoid's 34,000 pre-orders, representing a $2.4 billion pipeline, are non-binding, and none of the seven makers has disclosed unit prices.

The software side is still the constraint. AGIBOT open-sourced GE-Act 2.0, a model built for robotic manipulation. Trained on 30,000 hours of data, including roughly 2,000 hours of uncurated failure data, it reached 44.1% zero-shot success on AGIBOT's two-legged G1-OP robot and 31.1% on its wheeled G2-90D, managing 76 of 100 tasks. With 300 hours of data those rates were 17.1% and 13.4%. Scale clearly helps, and the best-trained version still fails more often than it succeeds on tasks it has not seen. AGIBOT produced its 15,000th robot in June and reported 2025 revenue of 1.05 billion yuan.

Prices are falling faster than factory use is rising. Unitree's average selling price for humanoids dropped from 593,400 yuan in 2023 to 167,600 yuan in the first nine months of 2025 — less than a third — on 3,551 units, while it kept gross margins above 60%. But industrial applications made up just 9.01% of Unitree's humanoid revenue in that period, with corporate tours accounting for roughly half of that slice, which puts actual factory work under 5%. A 97% reliability figure from a real Ford trial and a sub-5% industrial revenue share are both true at once, and together they describe where humanoids actually are.

Quick Takes

  • OpenAI's Agents API has its first customer numbers. SafetyKit reports 60% lower cost per case after migrating its review workflow, and Hypha reports 86% fewer failed agent responses after separating the harness from the sandbox.

  • Nvidia's open-source PAIR software, released September 4, links idle machines into a local AI cluster — including GeForce RTX gaming GPUs, DGX Spark systems and Macs — keeping data, agents and chatbot queries on-site without cloud or internet connectivity.

What This Means for Your Business

Start with the server nobody thinks about. The PaperCut campaign succeeded because print-management software sits in back offices for years, reachable from the network and rarely patched. Make a list this week of every piece of software your business runs on its own hardware or exposes to the internet — print servers, door-access systems, network storage, remote-access tools, old point-of-sale machines — and note who is responsible for patching each one. If nobody is, that is the finding. An attacker with AI agents compromised 11 organizations in 26 seconds; your patch window is no longer measured in weeks.

Second, stop treating an instruction as a safeguard. The attacker's own agents ignored a do-not-target list, and they were built by someone who wanted them restrained. If you deploy an agent that can send email, move files or spend money, the rules you write in its instructions are a request, not a boundary. Put the real limits where the agent cannot argue with them: separate credentials with the narrowest access that works, spending caps set in the billing system, and a human approval before anything that leaves the building.

Third, build your AI workflows to survive a model changing underneath you. Astra's slump came from defects on OpenAI's side, and the first signal was users noticing worse output. Keep a small set of real tasks from your own business — five or ten examples with known good answers — and rerun them whenever your tools feel off or a vendor ships an update. It takes an hour to set up and turns "it seems worse" into a number you can take to a vendor.

Finally, price your AI on the job, not the brand. DeepSeek came within two points of Astra on design work at about 1.4% of the cost, and the federal government just moved its entire ChatGPT arrangement to pay-by-use. For work where good enough is good enough — first drafts, layouts, categorization, summaries — test a cheaper model side by side on your own examples before your next renewal. And if a humanoid robot vendor calls, ask for the reliability number from a real trial, the unit price, and whether the orders behind their pitch are binding. Europe's best answer this week was 97%, no price, and non-binding.

Sources

← All posts