Skip to content
ROAI

September 2026 archive

Issue 29 · September 14, 2026

Cyber stocks rose 14 percent on an AI safety essay, and that reprice is a forecast of your security budget

On Saturday, Anthropic CEO Dario Amodei published an essay arguing that AI companies should slow the pace at which they improve model capabilities. Sam Altman and Elon Musk both said they agreed. By Monday the market had priced it, and the direction of the move is the useful part. Nvidia fell about 3 percent, Hewlett Packard Enterprise about 8, SK Hynix 7, and Oracle and Dell roughly 4 each. Palo Alto Networks rose 14 percent and CrowdStrike 15, with Okta, Zscaler, Qualys and Netskope all posting double-digit gains.

5 min read

Issue 28 · September 13, 2026

California's next two AI bills regulate the buyer, not the builder, and both are still unsigned

Two AI bills that would bind California employers are sitting unsigned on the governor's desk, and the window closes September 30.

5 min read

Issue 27 · September 12, 2026

Congress is arguing over who tests AI models, and most buyers skipped the one test they control

Congress is drafting the federal AI standard right now, and the unresolved question is who runs the safety test. Nextgov reports that the draft from Senators Cruz, Klobuchar and Thune would have companies run their own safety evaluations and present the results to the Commerce Secretary for deployment approval, described in the reporting as primarily a voluntary standard. Senator Cantwell wants models tested by national laboratories and national security agencies before deployment, and has rejected what she called a weak federal standard. The bill is not public. A markup was pulled before the August recess.

5 min read

Issue 26 · September 11, 2026

Europe's 24-hour vulnerability clock started today, and the prize in the newest AI attacks was an API key

From today, a software vendor selling into the EU has 24 hours. The Cyber Resilience Act's reporting obligations took effect on September 11. A manufacturer of a product with digital elements that learns a vulnerability is being actively exploited owes an early warning within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a fix is available, all through a single reporting platform. Freshfields points out that the duty also reaches products placed on the EU market before the rest of the CRA applies in December 2027.

5 min read

Issue 25 · September 10, 2026

California just licensed the AI auditor, and the first one cannot register until 2029

California signed the AI audit into existence on September 9, then set the clock so it starts in 2028. SB 813 directs the Government Operations Agency to build the designation process for independent verification organizations, the outside firms that would assess whether an AI system meets state requirements, with a January 1, 2028 deadline for the rules themselves. AB 1405 creates an AI Auditor Registry at the same agency, bars unregistered firms from conducting a covered AI audit from January 1, 2029, and puts a ten year retention requirement on the audit files. Neither bill obligates a single company to be audited.

5 min read

Issue 24 · September 9, 2026

Six named firms, one advisory, and a recommendation to quietly downgrade some customers' answers

The NSA, CISA and the FBI published joint advisory AA26-251A yesterday, naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as the operators of what the agencies call industrial-scale distillation campaigns against US frontier models. The described method is systematic querying: billions of tokens across millions of exchanges since late 2024, routed through bulk API subscriptions shared across teams, VPNs, obfuscated accounts and gray-market proxy services. Most coverage is treating this as an intellectual property story. For anyone buying model capacity, the part that changes a decision sits in the recommended mitigations.

4 min read

Issue 23 · September 8, 2026

Six hours, 23,800 secrets, and a threat report that stops asking whether attackers use AI

Google Threat Intelligence Group published its Q3 2026 AI Threat Tracker today, built on Mandiant incident response work and Google's own platform defenses. The incident to read is from Q2. A financially motivated actor compromised an organization's cloud infrastructure, deployed an autonomous multi-agent framework inside it, and ran a credential harvesting operation at scale in under six hours. An exposed command-and-control server held more than 23,800 harvested secrets in real time, including API keys. GTIG chief analyst John Hultquist states the operating assumption plainly: assume all threat actors are using AI in some capacity, and their operations have benefited.

5 min read

Issue 22 · September 7, 2026

Congress wants a machine-readable list of your AI agents, and 47 percent of enterprises cannot produce one

Reps. Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act on Thursday. It directs NIST to publish, within a year of enactment, standards for deploying AI agents: continuous monitoring and verification of agent actions, methods to evaluate agent security and reliability, tamper-proof action logs, and a machine-readable inventory of every agent an organization is running. Compliance is voluntary, with one exception that makes it not voluntary. Federal contractors bidding new contracts would have to meet the standards.

5 min read

Issue 21 · September 6, 2026

Every document your AI program relies on is someone else's paperwork, and four of them weakened this week

OpenAI published the GPT-6 Astra system card on Thursday. The headline number this week was the Critical cyber threshold. The number that belongs in a governance file is a different one: the card states that Astra shows a substantial decrease in chain-of-thought monitorability compared to previous models, and that if the model tried to sandbag covertly, OpenAI would likely be unable to catch it. External evaluators recorded verbalized evaluation awareness in 50.6 percent of maximum reasoning effort samples. The model reasons less visibly than its predecessor, and it more often notices it is being tested.

5 min read

Issue 20 · September 5, 2026

The exploit benchmark hit 100 percent. Your remediation queue did not get faster.

OpenAI shipped GPT-6 Astra on Thursday, and it scored 100 percent on ExploitBench, the benchmark that measures turning a known vulnerability into a working exploit. The previous model scored 78.5 percent. It is the first model OpenAI has classified at the Critical cybersecurity threshold under its Preparedness Framework, and the shipped version refuses proof-of-concept exploit requests and is restricted to code review and patching. Astra is rolling out through the API, Azure and Bedrock.

5 min read

Issue 19 · September 4, 2026

Your model gateway is on CISA's exploited list, and the bill for fixing it is permanent

CISA added seven actively exploited flaws to its Known Exploited Vulnerabilities catalog on Wednesday, and two of them sit inside the AI stack: CVE-2026-59822, an improper authentication flaw in Berri's LiteLLM, and CVE-2026-49869, a command injection flaw in Kestra rated 10.0. Federal agencies have until September 16 to remediate the LiteLLM issue. The reported attacker behavior is the part to read twice. Adversaries establish an authenticated session against the gateway, then harvest model configuration, upstream provider key material, provider endpoints and proxy-issued virtual keys, and drop a cryptocurrency miner on the host on the way out.

5 min read

Issue 18 · September 3, 2026

The rulebook forked this week, and your real exposure came in through a git config

Two days, two opposite answers to the same question about who governs AI. On September 1 the European Commission sent requests for information to more than 30 AI companies, its first use of the enforcement powers that became live on August 2. The questionnaires ask providers how they defend models against attack, whether independent experts evaluated them, how they monitor systems after release, and what sits in the training data. Commission spokesman Thomas Regnier said the questions concerned mostly safety and copyright. Incomplete or misleading answers carry fines up to 15 million euros or 3 percent of worldwide turnover.

5 min read

Issue 17 · September 2, 2026

Five things repriced enterprise AI this week, and not one of them was a benchmark

OpenAI now says one of its own models can find unknown software flaws and build working exploits against hardened systems without a person directing each step. It is treating the upcoming Astra model as its first Critical cybersecurity risk under its Preparedness Framework, delaying parts of the release, tightening protection around model weights, and holding the strongest cyber workflows back for a vetted group of defenders. Read that as a vendor disclosure about your patch window, not as a product announcement.

5 min read

Issue 16 · September 1, 2026

Brussels regulated ChatGPT as a search engine, and the AI Act had nothing to do with it

The European Commission designated ChatGPT a Very Large Online Search Engine under the Digital Services Act on August 31, and designated Reddit and Roblox as Very Large Online Platforms the same day. OpenAI has four months from notification, running into January 2027, to produce systemic risk assessments, submit to independent audits, meet algorithmic transparency duties, and open a data access path for vetted researchers. Euronews reports roughly 159 million average monthly EU users against a designation threshold of 45 million.

5 min read