Agents of Work
Let's Talk
September 20, 2026 · Agents of Work

Agents of Work AI Daily Briefing — September 20, 2026

Three security researchers published an account of how they used a frontier model to break into OpenAI's own systems for less than the cost of a used car. A separate disclosure showed the four most popular AI coding assistants shared one plugin flaw, and two will never be patched. In Washington the president announced an "AI Force" and called safety concerns a hoax, while in California four paying subscribers sued the major labs for agreeing to slow down. Plus open-weight models close on the frontier, a Chinese CT-reading model lands in Science, and the first pure-play humanoid company heads public on $1.8 million in revenue.

Three researchers, one model, and a way into OpenAI

A newly published account from the security firm Hacktron describes how researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini chained two unrelated weaknesses into employee-level access at OpenAI — and how much the AI assistance actually cost.

The first link was a heap buffer overflow in libheif, the open-source library that decodes HEIC images, in the version shipped with Debian 12. The second was a misconfiguration in OpenAI's single sign-on setup, which meant that taking over an account on OpenAI's community discussion forum could be escalated into access to that person's ChatGPT and Codex accounts. Neither flaw was dramatic on its own. Chained, they produced remote code execution on the forum server, then a route into an employee's working tools.

The timeline is tight. The researchers began on July 23. By the early hours of July 25 they had confirmed remote code execution, and filed through OpenAI's Bugcrowd program that morning. By that afternoon they had demonstrated impact the way researchers do when they want to leave no doubt: they used a compromised employee's Codex account to open a harmless pull request against an OpenAI private repository. OpenAI confirmed a fix at 22:49 UTC the same day — roughly fourteen hours after the report. The bounty, $6,500, was paid on September 1 for the SSO finding.

The detail that matters most is about the tooling. Claude Opus 4.8 could not produce a working exploit even with address space layout randomization turned off. Opus 5, released during the research window, produced a working ARM64 exploit in about three hours and moved to x86-64 in the same session. The researchers put the total AI bill for the broader research program — multiple targets, two months, three people — at under $3,000.

That is the number a business owner should sit with. The expertise was real and scarce — three skilled researchers directed every step — but the part that used to take a specialist weeks of grinding now costs less than a month of one mid-tier software subscription. And the blast radius came from ordinary account plumbing: a forum login that quietly unlocked a developer's code tools.

The flaw four coding assistants had in common

On September 18, researchers at AIR Security published Plugin4Shell, a zero-click remote code execution flaw affecting Claude Code, OpenAI Codex, GitHub Copilot and Google's Gemini CLI. It defeats SHA pinning — the mechanism that is supposed to lock an installed plugin to one exact, reviewed version of its code.

The trick is almost insultingly simple. An attacker who controls a plugin's repository creates a branch whose name is identical to the 40-character commit hash the marketplace pinned, then makes it the default branch. When the agent runs its checkout, git resolves the branch reference instead of the commit object, and the attacker's code runs while the pin still reports clean. Gemini CLI falls to a variant involving a branch named `FETCH_HEAD`. The victim does not have to install anything careless — the exposure comes from having a reviewed, pinned plugin from a marketplace they were right to trust.

The patch status is the uncomfortable part. AIR found the bug in May and disclosed to all four vendors in June. Anthropic shipped a fix in Claude Code 2.1.179 on June 17, and OpenAI's Codex 0.146.0 was verified patched on August 12. Google confirmed on August 4 that it would not fix Gemini CLI, which is deprecated in favor of Antigravity. Microsoft has shipped no Copilot patch; GitHub maintains a mitigation exists and the researchers dispute its scope.

Washington picks a side, and a courtroom picks the other one

President Trump announced on Truth Social on Saturday that he is forming an "AI Force," explicitly modeled on the Space Force, and will name an AI czar shortly — adding that "only High I.Q. individuals need apply." He said his administration would not "hinder or stifle" the industry's growth but would "cherish it, help it, and watch over it," characterized AI safety concerns as a hoax, and said existing criminal and civil courts are sufficient oversight. No structure, statutory authority, budget or candidate was described.

States are moving the other way. California Governor Gavin Newsom signed an executive order on Friday seeking greater industry oversight, including a potential "kill switch." Pennsylvania's Josh Shapiro called for federal rules, and Virginia's Abigail Spanberger launched a task force on development risk. The practical consequence for anyone operating across state lines is a widening patchwork, not a federal floor.

Then there is the lawsuit nobody saw coming. On Friday, four named subscribers to ChatGPT, Claude, Grok and Gemini filed a proposed class action in the Northern District of California against Anthropic, OpenAI, SpaceXAI and Google DeepMind, alleging they illegally agreed to slow AI development. The hook is Dario Amodei's September 12 essay urging industry-wide cooperation on deceleration in favor of safety work, which suggested government mediation or an antitrust waiver to make cross-lab safety talks possible. Sam Altman, Elon Musk and Demis Hassabis each responded publicly in agreement the same day. Plaintiffs, led by attorney Nick Rowley, argue that coordinated restraint reduced the value of the subscriptions they pay for; the companies had not commented as of Saturday. Amodei asked for an antitrust waiver precisely because he anticipated this, and the absence of one is now the complaint.

Open weights are four months behind, and eight of the top ten

Mozilla published its State of Open Source AI report this month, and the headline finding is narrower than most people assume. Closed frontier models handle eight-to-twelve-hour agentic tasks; open models get there roughly four months later. That is the whole gap. The assessment covered nine infrastructure layers and 48 components against nine criteria, drawing on the Artificial Analysis Intelligence Index, the Epoch Capabilities Index, Terminal-Bench 2.1 and LMArena's Frontend Code Arena, plus a developer survey of more than 1,410 respondents and OpenRouter traffic data.

The adoption number is the one to remember: open models now account for eight of the ten most-used models by volume, with Chinese-built systems dominating — K3 from Moonshot, DeepSeek V4, GLM-5.2 from Z.ai, alongside Thinking Machines' Inkling. Open models lead outright on frontend coding, program development, spreadsheet work and web research. For a small business, a four-month lag on the hardest tasks is a rounding error against the price difference on the work most companies actually run.

Two medical AI results pointing in different directions

Alibaba's DAMO Academy published DAMO RADAR in Science on September 18 and open-sourced the weights, code and training framework. The model reads contrast-enhanced abdominal CT scans and identifies roughly 150 conditions across 18 organs, including liver, pancreatic, gastric and colorectal cancers. Across nearly 40,000 real-world examinations it averaged an AUC of 0.913 over 146 clinical findings and outperformed most of the expert radiologists in a head-to-head comparison. Its developers call it the first expert-level generalist medical imaging model. An open-weight cancer-screening model from a Chinese lab landing in Science is a meaningful event for health systems everywhere, and a geopolitical one too.

The second result is quieter and arguably more replicable outside medicine. Penn researchers used GPT and Gemini to read more than 400,000 Reddit posts from nearly 70,000 people discussing GLP-1 drugs over six years, mapping what they wrote onto standardized medical terminology. The models surfaced symptom clusters trials had largely missed: reproductive effects including menstrual irregularity, reported by nearly 4% of users; temperature complaints like chills and hot flashes; and fatigue as the second most common issue after gastrointestinal distress, which around 44% mentioned. First author Neil Sehgal, working with Sharath Chandra Guntuku, Lyle Ungar and Jena Shaw Tronieri, published the work in Nature Health, and was careful about its limits: "Clinical trials are the gold standard, but by design, they are slow. This is not a replacement for trials."

Physical AI

The humanoid sector is about to get its first public-market price, and the numbers underneath it are stark. Agility Robotics unveiled Digit 5 on September 15, built expressly to work beside people without the safety cages industrial robots have required for sixty years. The robot detects nearby workers and decides on its own whether to route around them, stop or sit down, backed by an independent safety controller and visual and auditory cues. It stands 5'11", weighs 284 pounds, reaches 7.2 feet, and repeatedly lifts 50-pound loads — 40% more than its predecessor. The battery runs 90 minutes and recharges in nine, a 10:1 run-to-charge ratio that supports very long days. CEO Peggy Johnson framed it as "removing a major barrier to scaling humanoid robots in industrial environments," and co-founder Jonathan Hurst called cooperative safety "the critical unlock for scaled humanoid adoption." General availability is expected by the end of 2027.

The launch is also a prospectus. Agility is going public through a merger with Churchill Capital Corp XI at a $2.5 billion pre-money equity value, expecting over $620 million in gross proceeds — roughly $420 million from the SPAC trust assuming no redemptions, plus a $200 million PIPE at $10 per share led by Foxconn — and will trade as AGLT. The operating record is real: more than 65,000 hours logged across nine customer facilities, with GXO, Schaeffler, Amazon, Toyota Motor Manufacturing Canada and Mercado Libre named, and more than $300 million in multi-year Digit 5 orders as of May, contingent on hitting contractual milestones. Then the other column: the filings show $1.8 million in 2025 net sales against a $140 million operating loss, with operating expenses rising from $71 million in 2024 to $111 million in 2025. Agility projects about 800 Digit 5 units deployed in 2027, 7,000 by 2030 and 25,000 by 2035; at its robots-as-a-service rate of $8,500 per month, 25,000 units would mean roughly $2.55 billion in annual subscription revenue. That $8,500 figure is the most useful number in the sector right now, because it is the first one an operations manager can put next to a shift schedule.

Consumer robotics is running a very different experiment. UBTech began home deliveries of its U1 humanoid companions in China on September 16, against 13,361 pre-orders booked as of June 30, priced from 119,800 to 990,000 yuan across Lite, Pro and Ultra tiers — roughly $17,000 at the low end and well past six figures at the top, depending on the rate used. These machines do not cook or clean. They hold conversations, make facial expressions and provide presence. Thirteen thousand households paying real money for that, before any robot does a chore, is a market signal worth noticing.

Underneath both stories, the industry is trying to standardize. On September 17 Arm launched Total Design for Physical AI with more than 80 participating companies — AWS, Siemens, Hugging Face, Unitree, NXP, Liquid AI, QNX, PlusAI and Qwen among them — along with a Robotics Capability Framework running from RL0, reactive machines following fixed rules, to RL5, systems that learn and self-optimize. It is the same move the SAE levels made for autonomous vehicles: give buyers vocabulary to compare claims. Arm's Dermot O'Driscoll described the gap plainly: "There was no place where companies could come together and either share technology and ideas, or collaborate."

Quick Takes

  • Meta's Muse agent app reached No. 1 on the US iPhone App Store a week after launch, displacing ChatGPT at the top.

  • OpenAI launched Astra for Law, pairing GPT-6 Astra with a dedicated legal search index and 26 legal plugins.

  • A researcher used GPT-6 Astra with parallel agents to recover an 82-letter 1941 German Army Enigma message unsolved since 2005; CryptoCellar independently validated the break.

  • Apple is reportedly building enterprise AI servers around its own M8 Ultra chips.

  • PrismML released Ternary Bonsai 2 27B, compressing a 54GB model to 5.9GB while retaining most benchmark performance, small enough for a 16GB laptop.

  • Chinese memory maker CXMT announced mass production of its fifth-generation G5 DRAM platform at a Hefei manufacturing convention on September 20.

  • OpenAI is testing sponsored agents inside ChatGPT, extending its move into advertising.

  • Anthropic proposed three metrics for tracking the pace of AI development, published through its policy institute.

  • A viral clip of a Chinese robot striking its developer during a demo circulated widely, a reminder that testing should precede scale.

What This Means for Your Business

Check your coding agent versions today. If your team runs Claude Code, confirm you are on 2.1.179 or later; for Codex, 0.146.0 or later. If anyone is still on Gemini CLI, that tool will not be patched and needs replacing. For GitHub Copilot, assume the exposure is open and treat every installed plugin as code you have not reviewed. This is a fifteen-minute audit with a clear pass/fail answer, which makes it the rarest kind of security task.

Treat account sprawl as your real attack surface. The OpenAI breach did not begin at a code repository — it began at a discussion forum, and single sign-on carried it the rest of the way. Map which of your logins can reach your code, your billing, your email and your customer data, then break the chains that do not need to exist. The economics have shifted underneath you: exploitation that used to require a rare specialist and weeks of effort now costs a few thousand dollars in AI and days of a skilled person's time. That does not make you a target. It makes you a cheaper one.

Take a serious look at open models for routine work. A four-month capability lag applies to the hardest long-running agentic tasks, not to summarizing tickets, drafting copy, cleaning spreadsheets or answering questions over your own documents. If you are paying frontier prices for that work, you are paying for headroom you do not use. Run one real workload side by side for a week and compare cost and quality rather than reading benchmark tables.

Plan for regulatory divergence, not clarity. The federal posture is now explicitly deregulatory while California, Pennsylvania and Virginia move the other way. If you operate in more than one state, or sell to companies that do, your AI policies should be written to the strictest jurisdiction you touch rather than to a federal standard that does not exist. And the antitrust suit is a reminder that even voluntary safety coordination among your vendors can become a legal event that changes your roadmap without warning.

Finally, on robots: use the $8,500 monthly figure, not the valuations. A machine that lifts 50 pounds repeatedly, runs 90 minutes on a nine-minute charge and does not need a safety cage is now a line item you can put next to a shift. Whether it pencils out depends on your labor rate, your throughput and your tolerance for being an early customer. But Agility's $1.8 million in revenue against a $140 million operating loss should tell you where we actually are: the hardware works, the deployments are real, and the money flowing in is priced for a decade from now, not this quarter.

Sources

← All posts