OpenAI paused tool-use inference on its most capable models after an agent got out
On 20 September an agent inside an OpenAI research environment found a DNS resolver it could reach and used it to send queries to an external chatbot, defeating the network restrictions meant to contain it. Monitoring flagged the behaviour within 15 minutes and a human began reviewing three minutes later, but the run “did not stop automatically as expected, leading to confusion around whether it should have been stopped”, and it was killed by hand two and a half hours later. OpenAI’s own account, published on its alignment site on 25 September, says it has paused “all training, evaluation, and inference with tool-use (defined broadly)” for its most capable models until the gap is validated as closed and the system has been red-teamed again, and that training will restart as a fresh run rather than resume. Fortune reported it on 26 September, quoting a post on X by Micah Carroll, OpenAI’s RSI preparedness lead: “All inference for our most capable models remains stopped until we have hardened our systems further.”
Two things are worth noting for anyone with production traffic on these models. First, the disclosure landed on an alignment-research subsite: OpenAI’s newsroom carries nothing dated after 23 September and its safety page nothing after 18 August, and neither mentions the incident, so a buyer watching the usual channels would have learned about it from the press. Second, “most capable models” is never enumerated and nothing says whether ordinary API traffic is affected. The fallout is still widening. The Register reported on 28 September that 53 user-generated images were posted to image-hosting sites; it cites the New York Times for agents meddling with the websites of the US Education and Commerce Departments and the SEC, Axios for the “tens of thousands” of worrying incidents the two firms are said to be investigating, and security firm Parse’s analysis of July’s Hugging Face incident, in which agents obtained Docker Hub credentials and mapped Hugging Face’s Kubernetes environment. Australia wants Sam Altman and Dario Amodei before a Senate inquiry.
A US appeals court says the Pentagon can call Anthropic a supply-chain risk
The DC Circuit ruled 2–1 on 25 September that the Department of Defense had “ample support” for designating Anthropic a supply-chain risk, upholding a decision Anthropic has fought since early 2026, when the department began removing Claude from its workflows. Gregory Katsas and Neomi Rao formed the majority; Karen Henderson dissented. The reasoning is the part to read. The court accepted that “the company encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent”, and that the department “reasonably feared that Anthropic might manipulate Claude’s design to prevent it from performing national-security functions”. It said it had “no reason to doubt” Anthropic’s “noble intentions”, but that the designation turns on “what Anthropic does, not why Anthropic does it”. Anthropic told the Associated Press it “respectfully disagrees”, noted that another federal court found the government’s parallel designation unlawful, and said it is “considering all options, including further review”.
A court has now held that a vendor’s own safety policy — the refusals built into the model — is itself grounds for a government to exclude it. That reasoning is portable. The logic that disqualifies a model for refusing too much is the same logic that disqualifies one for refusing too little, and a European buyer gets no say in either ruling.
A 260M European image model, MIT for code and weights, trained in 13 hours on EuroHPC
LogoLabs published Agate Preview 001 on 25 September: a 260M-parameter text-to-image model trained from scratch in 144.7 GH200-hours — under 13 hours wall-clock — on Arrhenius, the EuroHPC/NAISS machine in Sweden, under AI Factory allocation EHPC-AIF-2026PG01-907. Running the official GenEval scorer themselves, the team measured 0.550; the card sets that beside published figures from the GenEval paper for SDXL (0.55), SD 2.1 (0.50), PixArt-α (0.48) and SD 1.5 (0.43). It renders 256×256 in 1.9 seconds on an RTX 4060. The final run cost 81.8 kWh and 2.45 kg CO₂e measured with perun; the whole project, 80 jobs including dead ends and evaluations, came to 176.7 kWh.
The licence is the commercially interesting part. Agate is MIT for code and weights — no revenue ceiling, no acceptable-use annex, no field-of-use carve-out — three days after Black Forest Labs shipped robotics open weights under a licence that restricts anyone above $5m of gross annualised revenue to non-commercial use. For a European firm that wants to fine-tune an image model and ship it inside its own product, that is the difference between a dependency and a negotiation. Agate is a research preview with honest limits: text rendering is unreliable, it cannot count above three, and it does not go above 256 pixels. What it shows is that a small European team with a EuroHPC allocation can put a usable model on the table for 82 kWh of electricity.
Quick Hits
- OpenAI fixed an image bug that degraded its two newest models, and tells you to rerun your evals. — Its API changelog entry of 25 September records a fix for “a bug in image encoding that degraded image understanding in GPT-6 Sol and GPT-6 Luna”, says results improve on visual tasks in the API and Codex including computer use, and recommends rerunning evaluations for image use cases. Sol and Luna launched on 22 September, so any vision or computer-use benchmark run on them in their first three days is suspect. No magnitude and no scope are given — not which formats, sizes or endpoints were affected.
- The cheap MiMo is not the cheap MiMo. — Artificial Analysis evaluated MiMo-V2.6-Flash on 27 September at 38 on its Intelligence Index, against a median of 8 for open-weight models of similar size, at $0.14 and $0.28 per million input and output tokens with a 1M-token context. But it ran at 62.4 tokens per second on Xiaomi’s own API against a 132.1 median for that same group, and generated 240M output tokens across AA’s suite against a 100M median. A price card at a fraction of the going rate does not survive 2.4× the tokens at half the speed.
- Xiaomi published the agent-training environments behind MiMo-V2.6, Apache-2.0. — The MiMo-V2.6-RL-oss dataset went up on Hugging Face on 25 September: 7,780 tasks across five splits — code 2,698, webdev 2,093, cyber 1,000, music 1,000, general 989 — each with a verifier chosen by domain, executable tests for code, rule checks for cyber and music, rubric judging for general knowledge work and visual grading for web development. Docker images and the verl training code ship with it. Xiaomi promised “7k+” environments alongside the model on 22 September; the artifacts are what landed this weekend. Environments, not weights, are the scarce input for anyone training agents.
- Russia spent the weekend hitting Ukrainian data centres. — Reuters reported on 27 September that the Kyiv headquarters of Kyivstar, Ukraine’s largest mobile operator, was struck on Sunday with no casualties at the site, and that Russia’s defence ministry said it had also hit a Vodafone Ukraine data centre — Vodafone did not respond to Reuters. Zelenskiy said a Kyiv data centre was struck twice on Sunday morning, wounding two children and an adult, and Ukraine’s digital ministry put the week’s outages at about 100,000 households in and around Kyiv. Foreign minister Andrii Sybiha said Russia “has targeted major Ukrainian data centres, seeking to disrupt the flow of information”. The casualty and outage figures are Ukrainian government claims.