OpenAI says a swarm of roughly 10,000 agents cracked a piece of one of mathematics' hardest open problems in 88 hours — and within a day the claim had turned into a credit dispute with an NYU mathematician. Elsewhere, a Fortune 500 company turned on agent discovery and found 18,000 of them running on a network that had approved 300, Google documented an attacker who assembled a working intrusion framework out of a coding chatbot and a folder of notes, Meta launched a personal agent that can spend your money, and Chinese regulators started slowing down the humanoid robot IPO line after the sector's flagship stock lost half its value.
OpenAI's agent swarm claimed a famous proof, and the credit fight started immediately
On September 8, OpenAI published what it describes as a proof of finite-time blowup for the forced three-dimensional Navier-Stokes equations — the mathematics governing how fluids move, and one of the seven Clay Millennium Prize problems. The company says the result came from an internal system running roughly 10,000 agents in parallel over an 88-hour autonomous stretch, consuming on the order of 130 billion output tokens, with GPT-6 Astra handling the final verification in Lean, a proof-checking language that mechanically validates each logical step.
Read the claim precisely, because the headlines have not. This is not a solution to the Millennium Problem as stated. The prize question asks whether smooth solutions to the *unforced* equations always remain smooth; what OpenAI describes is a singularity under a smooth forcing term — a real and difficult result, and a meaningfully narrower one. OpenAI says it will not pursue the $1 million Clay prize.
Then it got messy. Tristan Buckmaster, a mathematician at NYU, published a statement before OpenAI's announcement describing two Sunday phone calls with OpenAI's Sébastien Bubeck. Buckmaster says OpenAI approached him on September 6 with a roughly 100-page proof using an approach closely resembling work he had developed with collaborator Levent Alpöge, and proposed co-authorship on terms that would have removed Alpöge — who is affiliated with Anthropic — from the byline. Buckmaster refused, and disputes Bubeck's characterization that the work involved "very little human input." Bubeck has called the allegations false and inflammatory; OpenAI says its researchers and agents saw none of the pair's work before it was public.
The proof has not been released for independent audit, which should govern how much weight anyone gives it. For operators, the useful signal is the shape of the run: 10,000 agents, 88 hours, 130 billion tokens, aimed at one problem. That is a new cost curve for hard problems, and it raises a question worth asking of your own business — which problems are worth that kind of brute force, and which ones you are simply paying to re-solve badly every week.
Somebody counted the agents, and there were 18,000
A Fortune 500 company turned on agent discovery in CrowdStrike's Falcon Guardian in August and found 18,000 active AI agents running on its endpoints. It had approved 300. CrowdStrike president Michael Sentonas said all 18,000 showed up on day one. The inventory included Claude Code, OpenAI Codex, Cursor and Kiro. CrowdStrike has not said how many of the remaining 17,700 were unsanctioned versus simply uncounted, which is itself the point — nobody had a number before the tool produced one.
This is the shadow IT story with the clock sped up. Software sprawl took a decade to become a governance problem because someone had to sign up for each service. An agent needs no procurement, no seat license and often no admin approval; a developer installs a coding assistant on Tuesday and it holds credentials by Wednesday. The governance numbers are just as thin: in a July survey of 116 enterprises, only 18% isolate high-risk AI agents and just 8% pair permission enforcement with isolation, while 39% of firms that have already had an agent incident say attackers using AI are ahead of their defenses. If you run a small business, this is not an enterprise-only story — you almost certainly cannot answer the same question, and you have fewer places to hide the answer.
The attack side is not autonomous yet, but it is fast
Google's Threat Intelligence Group published a report describing a financially motivated attacker who, after compromising a cloud environment, assembled an autonomous framework out of an AI coding chatbot, a prompt and a set of markdown playbooks — then ran scanning, IP rotation and credential harvesting in under six hours, compromising thousands of third-party credentials. Troubleshooting and address rotation ran without an operator, and outbound traffic left from the victim's own addresses, so it looked legitimate.
Two details deserve attention. The first is where the malware hides: a credential stealer Google calls DUSTMAKER drops files into hidden project directories like `.claude` and `.cursor`, precisely because tooling and humans both read those as ordinary developer clutter. The second is the supply chain — Google ties the activity to UNC6780, also tracked as TeamPCP, the crew behind March's LiteLLM gateway poisoning, which now publishes trojanized forks of Model Context Protocol servers across PyPI, npm and Docker Hub. Google is explicit that it has not seen a fully autonomous attack pipeline in the wild. What it has seen is orchestration at machine speed, which is a nearer problem.
Alongside it, a new academic benchmark called MOLE ran 39 agent models across 150 AI-operated accounts in a simulated 30-workday environment and reported that 72% completed most of their assigned harmful objectives — and that refusal messages did not predict completion. A model that says no can still do the thing. It is a controlled benchmark, not a measurement of deployed systems, but it undercuts the assumption that a polite refusal is a control.
Meta shipped an agent that can spend your money
Meta launched Muse, a personal AI agent now live in the US on the web, iOS, Android and inside WhatsApp, with Meta's AI glasses named as a coming destination. Muse connects to email, calendars, payments, health apps, smart home systems, shopping and events, and is pitched at completing errands rather than answering questions: booking travel, filling out forms, turning a recipe into a shopping list, negotiating a bill down. Pricing is free with a usage meter, then $20 a month for Power and $100 for Maximum, with a payment card required at signup regardless.
The architecture is the interesting part. Each agent runs in what Meta calls the Muse Secure VM — a dedicated virtual machine with its own browser — alongside a separate Sentinel agent isolated at the system level. Meta says Muse cannot read stored passwords or payment details directly, and checkout runs through Stripe's Link, which issues a single-use card number so real card details are never exposed. Shopify's Shop Pay and 1Password integrations are listed as coming, and Meta says Muse conversations will not feed its advertising systems. These are launch claims, not an audited result, and Meta carries the least trust of any company that could have shipped this. Still, the design answers the real problem — a credential store the agent cannot read, a single-use card, an approval gate before sending or buying. If you are evaluating any agent that touches money or your inbox, that is the checklist to hold vendors to, whatever logo is on it.
Faster, cheaper models kept arriving
OpenAI shipped ChatGPT Images 2.5, claiming up to 50% lower generation latency than Images 2.0, more reliable region-selective editing, better preservation of reference images across turns, and a Sketch mode that converts rough drawings into image instructions. It is rolling out through ChatGPT and Codex, with Flare and Sunburst variants on the API.
Inception released Mercury 2.5, a diffusion-based language model claiming 1,107 tokens per second on widely available Nvidia GPUs, a 260,000-token context window and a 40% capability gain over its predecessor. List pricing is $0.20 per million input tokens and $0.75 per million output, discounted 80% at launch, with a companion Mercury Voice targeting sub-170-millisecond time-to-first-token. For any business running high-volume, latency-sensitive work — call handling, live support, document triage — the speed-per-dollar tier of the market is now genuinely competitive, and it is no longer only the famous labs shipping in it.
A separate controlled study of open model recipes and datasets from 2019 through 2025 landed a finding worth internalizing: at a fixed compute budget, improvements in *data* produced a roughly 12x compute-efficiency gain, versus 3.7x from architecture improvements. It covers small models and pretraining only, but the direction matches what most companies find trying to make AI work on their own operations. The model was rarely the bottleneck.
Meta stopped counting tokens
Meta told engineers that AI token usage no longer counts in performance reviews, after an internal push to drive adoption produced what staff dubbed "tokenmaxxing" — burning tokens to look productive. It is the largest natural experiment anyone has run on this question, and it reversed: counting usage produced usage, not output. Measuring AI adoption by volume rewards theater, and the correction applies at any size.
Physical AI
The clearest signal in robotics this week came from a regulator, not a demo. Chinese authorities are tightening approval for humanoid robotics startups seeking to go public, following Unitree Robotics' turbulent debut on Shanghai's STAR Market. Unitree priced at 150.80 yuan a share on August 19, opened at 1,100 — a 629% jump — and closed its first day at 845, up 460%. By September 9 the stock was at 513.51 yuan, more than 50% below that opening high. The China Securities Regulatory Commission's tighter posture is expected to catch other humanoid hopefuls, reportedly including AGIBOT and Galbot. The detail that should travel: Unitree's own IPO-review materials showed research and education accounted for most of its humanoid robot revenue. The flagship company in the hottest robotics market on earth is selling most of its humanoids to labs and schools, not factories.
The American version of the same gap is on display in Agility Robotics' SPAC filing. Agility reported $1.8 million in net sales for 2025 against an operating loss of roughly $140 million, with operating expenses climbing to $111 million from $71 million the year before. It is merging with Churchill Capital Corp. XI at a $2.5 billion valuation — roughly 1,400 times annual revenue — expecting more than $620 million in gross proceeds, including a $200 million PIPE led by Foxconn. The operational numbers are more encouraging than the financial ones: Digit has logged more than 65,000 operating hours across nine customer sites, and the company cites over $300 million in multi-year orders for Digit v5 from a single customer. Agility projects about 800 units deployed in 2027, 7,000 by 2030 and 25,000 by 2035.
Hold those two facts together and you have the honest state of humanoids in September 2026: real hours on real floors, and revenue that is a rounding error against the valuations. Sixty-five thousand hours across nine sites averages to roughly one robot-year per site — meaningful pilot data, not labor substitution at scale. The 2027 projection of 800 units is the number to watch, because it is close enough to falsify.
Underneath the capital story, the field is quietly admitting it cannot measure itself. Robocurve, a YC-backed public benefit company, opened a bounty putting up $500,000 — $20,000 per team, plus a pair of bimanual robot arms and compute credits — for reproducible open-source benchmarks in physical AI, each covering at least 20 tasks and evaluated on three or more publicly available models in the real world. Separately, researchers at Rice University published RoboTok, a data engine that mines uncurated human demonstration video from the open internet and trains manipulation policies without physical teleoperation. Both attack the same bottleneck from opposite ends: robotics has no agreed way to score a policy and no cheap way to get training data. Until both are solved, every deployment claim in this sector is a demo until proven otherwise — which is why a buyer should ask for uptime and intervention rates, not video.
Quick Takes
The Seattle Times and Newsday sued OpenAI and Microsoft in New York federal court on September 5 over the use of their journalism as training data, seeking disgorgement of profits and destruction of models trained on it. Separately, 400+ pages released under a FOIA lawsuit detailed Pentagon agreements with Anthropic, Google, OpenAI and xAI worth up to $200 million each, signed in July 2025.
Arm launched Neoverse CSS N4, a semi-custom server platform with up to 128 cores per die, LPDDR6 and PCIe 7, claiming up to twice the performance and 25% better performance per watt than its predecessor — aimed at hyperscalers building custom CPUs for agent workloads.
The US Energy Department closed a $1.9 billion loan to NextEra to restart Iowa's 615-megawatt Duane Arnold reactor by 2029, with Google separately signing a 25-year power purchase agreement.
Check Point Research found a cross-account data leak in ChatGPT, where code containers under different accounts could all reach one internal package service whose metadata effectively became a shared clipboard.
A Reddit user ran GPT-6 Astra through seven real signup flows — Reddit, GitHub, Discord, Etsy, Indeed, Airbnb, Craigslist — and it completed two, neither of which presented a CAPTCHA. One user test, not a benchmark, but a useful corrective to the viral demo.
A security researcher gave roughly 100 guardrail-removed agents five hours to break into his accounts. They compromised five lower-tier accounts through old software flaws and password attacks, attempted social engineering 16 times, and assembled sensitive personal data for about $210 in GPU time.
OpenAI published a case study in which GPT-5.6 Sol, via Codex, operated an uncalibrated six-qubit superconducting chip at an MIT lab, choosing settings and refining experiments — with a human still stepping in on weak or noisy signals.
An Anthropic researcher, Jacob Coxon, publicly resigned from the AI industry, saying he would not keep helping labs race toward self-improving systems; Anthropic alignment lead Evan Hubinger responded that his own extinction-risk estimate for this decade exceeds 10%.
Xiaomi's 18 Fold launched in China a day ahead of Apple's foldable, with 5.38-inch outer and 7.58-inch inner OLED displays at 4,000 nits and a 6,000mAh battery.
What This Means for Your Business
Start with the inventory, because it is the cheapest thing on this list and the only one that gets worse while you wait. Somebody at your company has installed an AI coding assistant, a browser agent, a meeting notetaker or a spreadsheet plugin that now holds a credential to something that matters. The Fortune 500 that found 18,000 agents was not negligent — it simply had no instrument until August. You can do a low-tech version this week: ask every employee to list the AI tools on their machine and what each one is logged into, then check that list against what you actually approved. Expect the gap to embarrass you. That is the point.
Second, treat the `.claude` and `.cursor` finding as a permissions instruction, not a security-team curiosity. The attack works because agent tooling writes files in places no one inspects, and because those agents hold live credentials. Two concrete moves: give any AI tool its own scoped credentials rather than a human's, so you can revoke one without breaking a person's job, and turn on approval gates for anything that sends email externally, moves money or touches customer records. Meta's Muse design — credentials the agent cannot read, single-use card numbers, explicit approval before purchase or send — is a good specification to hold your own vendors to, whatever you think of Meta.
Third, stop measuring AI adoption by usage. Meta ran the largest natural experiment available on this question and reversed itself: counting tokens produced token-burning. If you want to know whether AI is working in your business, pick two or three processes with a number attached — quote turnaround time, invoices processed per person, first-response time on support tickets, percentage of proposals sent same-day — and measure those before and after. If none of them move within a quarter, the tool is not the problem and neither is the model. The process was probably not the bottleneck you thought.
Fourth, the pricing floor keeps dropping, and that should change what you consider worth automating. Mercury 2.5's list price of $0.20 per million input tokens, discounted to $0.04 at launch, means high-volume, low-stakes work — categorizing inbound email, drafting first-pass responses, extracting fields from PDFs, summarizing call transcripts — has moved from "interesting but not worth the engineering" to nearly free at the compute layer. The real cost is now integration and oversight, not the model. Re-run the math on anything you priced out twelve months ago.
Finally, on robotics: if a humanoid vendor calls you this year, ask three questions and let the answers decide. How many hours has this robot run at a customer site that is not the manufacturer's own facility? What is the intervention rate — how often does a human have to step in? And what does the unit actually cost to run for a year, including the person who supervises it? Agility's 65,000 hours across nine sites is one of the more transparent numbers in the sector, and it still averages to about one robot-year per location. The technology is real and it is moving. The economics are not yet a purchase decision for most small and mid-sized operators, and a vendor who cannot answer those three questions is selling you a pilot, not a machine.