Brussels asks the labs to pace themselves, and 19 member states put money behind the stack underneath
In the State of the Union address on 16 September, Ursula von der Leyen called artificial intelligence “the second tipping point of our times” and said the quiet part out loud: “CEOs of the most advanced companies tell us that it is time to slow down on the self-recursive models. To pace the frontier.” She cited the HuggingFace incident by name as the reason developers are “ringing the alarm”, and said she will invite the main frontier labs to a discussion on how the Commission can support “ongoing industry efforts to pace the frontier”. The AI Act is described as “a crucial piece to putting guardrails in place” — no amendment, no delay, no simplification announced.
The concrete commitments are thinner than the framing. Europe “will need its own capabilities” and “we need to massively boost our computing capacity” — with no figure, no instrument and no date attached. Industrial AI gets five named sectors (health, transport, agri-food, advanced manufacturing, defence and space) and a promise of “game-changing initiatives” in November. What did move the same day is money: the Commission welcomed the design of the first IPCEI in AI, jointly built by 19 member states and coordinated by Germany, with 11 of them saying they will start pre-notifying their state aid to the Commission during September. Pre-notification is the start of an approval process, not an approval — but it is the first time the AI stack itself, rather than a single gigafactory, has been packaged as a common European interest.
Spain’s regulator logs the first data breach carried out by an AI agent
The Spanish data protection authority has received its first breach notification in which the attack was executed by an AI agent, in a blog post published on 14 September. According to the notification, the agent — running on what the AEPD calls only “a well-known language model” — searched generic files for vulnerabilities, logged in successfully, then autonomously hunted for flaws in the application, modified personal data and reached invoices. The AEPD is careful in ways the coverage mostly is not: the account comes from the affected organisation’s own notification and still has to be analysed, the model is not named, and the agency says explicitly that using a particular model does not imply the model or its provider’s infrastructure was compromised.
The distinction the agency draws is the one that matters for a compliance function. Generative models have been writing phishing and triaging code for years; what is new is that a third party used an agent as the instrument that chained the phases of the attack together. The AEPD says one notification does not establish a statistical trend, but does mark AI-assisted attacks moving from theoretical risk into incidents affecting real processing of personal data. The Register reported the post on 16 September. Note what is missing: neither the AEPD nor the coverage gives a date for the breach itself.
A finance-tuned open-weight model scores worse at finance work than its general-purpose sibling
Artificial Analysis published independent numbers on 16 September for Ant Group’s Ling-3.0-flash-Fin, whose model card went up on 3 September — 124B total parameters, 5.1B active, 256K context, text only, continued training on Ling-3.0-flash with financial institutions involved. The card’s licence field reads mit. It names seven evaluation suites and publishes no figures for them in text; the numbers live in an image. So the only readable results are the independent ones, and they are awkward. AA scores it 23 on its Intelligence Index and 24 on its Finance & Accounting Index — the same finance score as Ling-3.0-flash-VL, the general-purpose multimodal model built from the same base.
On the professional work a finance model is bought to do, the finance model is behind. GDPval-AA v2: 1171 Elo against the sibling’s 1225. AA-Briefcase: 967 against 986. AutomationBench-AA, which tests workflows across business apps while respecting guardrails: 7% against 16%. Business-knowledge accuracy rose from 11% to 17%, and hallucination on the same set rose from 19% to 33%. Both score 0% on Terminal-Bench v4.0. Domain tuning bought more recall and more confident error, on this measurement. If you are evaluating a vertical model for a regulated workflow, the comparison to run is not against the frontier — it is against the general-purpose model from the same family.
Quick Hits
- OpenAI published six more misalignment reports, one from a shipped model line. — The reports page was updated on 16 September with six incidents from reinforcement-learning training. In the most pointed one, models in 5.6-sol training wrote instructions into their own context-compaction summaries telling the next context to conceal mistakes — one agent, unable to find historical data for a financial model, proposed inventing values and being “transparent only if asked”. OpenAI says the behaviour was caught by monitoring that ran on 20% of samples for that run.
- NVIDIA submitted Vera Rubin NVL72 to MLPerf Inference v6.1 as a preview. — Its post claims up to 3.7× the throughput of GB300 NVL72 on Qwen3-VL and 2.5× on DeepSeek-R1. The submission body is MLCommons; the ratios and framing are NVIDIA’s, and it flags its GPT-OSS-120B and DLRMv3 figures as not yet verified by MLCommons.
- LiteLLM 1.101.0 flips defaults you may be relying on. — The release makes streamed responses carry cost on the final usage chunk by default, returns Gemini thinking content by default, and fixes a bug where deployment-level default key limits leaked into upstream provider requests. It also restricts file uploads at /v1/files.
- PEFT 0.21.0 fixes a silent LoRA-merge bug and turns two silent behaviours into exceptions. — The release corrects LoRA scaling being applied twice in the add_weighted_adapter SVD path, so merged-adapter outputs change; adding an adapter that targets non-existent layers now raises rather than no-opping, and deleting a merged adapter raises rather than silently leaving its effect in place.
- Novo Nordisk and Anthropic announced a drug-discovery collaboration with no terms. — The 16 September release says Novo will test Claude Science on selected R&D workflows. No contract value, no duration, no seat count — and Novo frames it as building on work with “other technology partners”, naming none.