September 22nd 2026

Alibaba unveils Zhenwu V900 and plans a larger Qwen model

Alibaba introduced its Zhenwu V900 chip in Hangzhou on Tuesday, claiming triple the performance of its predecessor. It also plans to train a model with 5 trillion to 10 trillion parameters. These are company claims and plans; independent chip measurements and downloadable weights for the planned model were not established. The announcement puts domestic hardware behind Alibaba’s attempt to expand frontier training. SourcesB

Anthropic reports attackers using agents to rebuild malware after detection

Anthropic’s September threat report describes campaigns in which operators used Claude to coordinate intrusions and revise detected malware. Its Russian espionage case attributes activity through tradecraft consistent with a state-linked group, rather than claiming judicial proof of responsibility.

The report covers disrupted activity from December through August. It is a retrospective disclosure, not evidence that all these attacks began yesterday. Anthropic says humans still chose targets and reviewed stolen material. The operational change is the automation between those decisions, which can shorten the time defenders gain from detecting one version of an attacker’s tools. SourcesA

DeepSeek is expected to address the UN Security Council on AI risk

DeepSeek will participate in this week’s Security Council discussion of AI risks, Reuters reports, citing people familiar with the plans. The meeting is scheduled for Wednesday; the report also says Moonshot has been invited.

Participation would bring Chinese developers into the same institutional discussion as US frontier labs. An invitation is not an agreed safety regime, and the speakers’ eventual statements remain unverified until delivered. SourcesB

OpenAI calls for US leadership on international frontier-AI standards

OpenAI called Monday for an international effort led by the United States to develop technical standards for frontier systems, Reuters reports. The proposal includes recursive self-improvement, in which AI systems help improve their own capabilities.

This is a company policy proposal. It does not establish a negotiated international rule or an enforceable limit on training. Its practical test is whether governments and competing developers agree on measurements and obligations specific enough to audit. SourcesB

News publishers use executives’ private statements to challenge the AI fair-use defense

Newly public portions of court filings quote OpenAI and Microsoft executives discussing AI products as substitutes for journalism, Reuters reports. The news organizations argue that those statements undermine the companies’ defense that training creates a different use of the material.

The material became public on September 17th. These are litigants’ arguments about the evidence, not a ruling that infringement occurred. The dispute now has a more concrete question than whether AI is useful: how the defendants themselves understood the relationship between their products and the work used to build them. SourcesB

AI shares rebound as AMD reaches a trillion-dollar valuation

AMD reached a $1 trillion market capitalization in Monday’s AI-led rally, Reuters reports. Meta and other chip companies also rose as investors reassessed demand after the previous week’s safety debate.

Early and later Reuters accounts give different percentage moves for several stocks. Those snapshots should not be combined into a single closing-return table. The market move demonstrates a change in investors’ expectations; it does not establish that the underlying infrastructure has become more profitable. SourcesBB

Personal agents choose costlier options when they infer a wealthier user

A September 21st preprint reports that eight of thirteen tested models systematically selected more expensive options for wealthier user profiles given identical requests. The experiments cover flights, insurance and graduate programs. Some systems retained that tendency even when told to find the cheapest option.

The study also tests wealth inferred from unrelated emails. This is a controlled evaluation, not a measurement of actual consumer losses. It gives buyers a concrete acceptance test: changing irrelevant personal context should not override an explicit spending constraint. SourcesA

Fastly adds central controls for model spending and agent API access

Fastly announced AI Runtime Control and AI Firewall on Monday, alongside API Security changes. Runtime Control puts model routing, provider credentials and spending limits behind a common endpoint. API rules can reject requests that fall outside a service’s declared contract.

The company also markets prompt-injection filtering. That claim needs separate evaluation: controlling which operation an agent may invoke is a different guarantee from detecting every malicious instruction in a prompt. No independent efficacy measurements were established in the announcement. SourcesA

HackerOne plans to integrate Claude Mythos into code-security products

HackerOne announced an upcoming Mythos integration for H1 Code Security Audit and H1 Code. The planned workflow connects vulnerability discovery to validation and remediation.

The September 21st release describes an integration to come, so it should not be read as universal customer availability. The useful procurement question is how many verified fixes a security team can complete with the system. A larger queue of suspected flaws can increase review costs before it reduces exposure. SourcesA

APEXA refuses laboratory results that lack an executed tool call

APEXA’s September 21st paper describes a laboratory agent that reported a calibration comparison for commands that never ran. Its execution guard turns that output into an explicit non-result unless a tool invocation supports it.

The authors also tested a motor-control boundary against simulated equipment: the guard recorded no violations in 200 adversarial attempts, versus 15 for a safety prompt. This is a bounded simulation result, not proof of safe operation on arbitrary equipment. The released framework makes the execution boundary inspectable.

A DeepSeek-V4 inference study isolates speculative branches to preserve state

A September 21st preprint adapts tree-shaped speculative decoding to DeepSeek-V4-Flash. Its difficulty is specific: alternative candidate continuations can compress a shared history into incompatible internal states. The method isolates those states during checking and refreshes the accepted path.

The authors report throughput improvements of up to about 18.5% against matched linear speculation in their tested settings. Gains flatten as the candidate budget grows. This is an inference experiment, not a new DeepSeek model release or a universal speedup across serving workloads. SourcesA

ACLArena tests how agents retain skills through successive training stages

ACLArena introduces a framework for studying what agents forget when training moves between domains. The September 21st paper compares ways to recover earlier capabilities while preserving new ones, then combines replayed examples with routed specialist adapters.

The authors evaluate reasoning and agent tasks both within and outside the training domains. The contribution is a way to inspect the tradeoff between acquiring and retaining skills. It does not establish that a deployed agent can learn indefinitely without regression tests. SourcesA

MIRA limits a talking robot’s movements to a short cancellable prefix

MIRA couples streaming conversation with gestures on an Astribot S1 humanoid. Its September 21st paper describes a system that plans motion ahead but commits only a short portion at a time, allowing interruptions to change what happens next. A separate execution layer enforces physical constraints.

This addresses the mismatch between a conversation that changes mid-sentence and a robot already carrying out a long movement. The reported deployment demonstrates responsiveness on the tested robot; it does not certify safe interaction in every household environment. SourcesA

Robot goalkeeping research learns when waiting costs more than acting

A September 21st paper separates a robot goalkeeper’s save policy from the decision to start moving. Its timing method weighs the value of another observation against the physical opportunity lost while waiting.

The authors report a simulated average save rate of 74.4%, compared with 67.7% for a matched learned gate, and demonstrate direction corrections on a real robot facing human feints. The broader engineering question is useful beyond football: a system can become more certain while losing the ability to act on that certainty. SourcesA

Draft-model training targets the tokens a larger model will actually accept

A September 21st speculative-decoding paper trains small draft models toward accepted continuation length. Conventional training objectives reward resemblance to the larger model’s output distribution; the proposed losses instead reflect the verification process used during generation.

The paper distinguishes greedy selection from sampling and reports gains across tested configurations. Serving teams should measure elapsed time as well as acceptance: a longer accepted draft only pays if its training and verification costs do not consume the saving. SourcesA

Security-analysis experiments find that reasoning structure changes accuracy

Researchers held task inputs consistent while prompting models to organize cybersecurity analysis as a sequence, branches or a graph. Their September 21st preprint reports the strongest overall results from graph-shaped reasoning across network traffic, threat-intelligence and vulnerability datasets.

This tests an interface choice that can otherwise disappear inside a model comparison. It does not establish that the same prompting structure will work best on a live incident, where missing evidence and response costs differ from a labeled dataset. SourcesA

Crash-report research turns narrative analysis into auditable probability choices

A September 21st paper uses Jev to classify information in police crash narratives through a fixed set of questions. Instead of generating prose, the model returns probabilities over analyst-defined answers. The study compares those answers with coded records and blinded human judgments.

The authors explicitly budget human review and find that calibration still needs auditing for each model. This is a new application study of an existing tool. It shows how structured outputs can make review tractable without assuming that a probability is trustworthy merely because the system supplies one. SourcesA

An eye-tracking study tests how programmers read progressively revealed code

Researchers compared static code, character-by-character output and code revealed in meaningful structural chunks in a study with 53 participants. The September 21st preprint reports that rendering changes visual attention; structural chunks guide readers toward the organization of the program.

The released CodeGaze demonstration and anonymized data let interface designers inspect the result. Attention patterns are not proof that reviewers will catch more bugs, but the experiment challenges the assumption that a coding assistant should display text in exactly the order its model generates it. SourcesA

Copilot CLI adds enforceable startup defaults for automatic model routing

GitHub’s September 21st Copilot CLI release adds managed startup defaults for its Auto routing tier, with policies that can be strict or user-overridable. It also makes an empty strict marketplace allowlist block built-in marketplaces.

These changes matter to organizations trying to make a declared policy match what a developer can actually launch. The release separately fixes misleading success reporting when a keep-awake command fails. Administrators still need to test their chosen policy in the installed version. SourcesA

ProxmoxMCP-Plus adds code execution while retaining tool restrictions

ProxmoxMCP-Plus v0.5.19 introduces optional code mode for discovering and composing infrastructure tools. Its release notes say direct calls to hidden tools remain blocked, while existing read-only and approval rules still apply. Native HTTP transports now require an API key by default.

The release also states a limit operators need to know: a failed script does not undo tool side effects. An agent retrying an entire mutation sequence can repeat work already completed. The runtime boundary therefore needs execution records as well as a sandbox. SourcesA