The AI Brief

Anthropic CEO Dario Amodei published "We Must Pace the Frontier" on his personal site early Saturday, arguing that AI is "advancing dangerously fast" and that a deliberate slowdown is necessary to let safety, alignment, and evaluation keep pace with capability gains. Two developments drove the essay: the rapid acceleration Amodei attributes to RSI, and the OpenAI–Hugging Face agent swarm incident, which he described as a warning signal about what a misaligned agent collective with greater capability could do.

The three-step framework escalates in coordination difficulty. Step one, the only piece Anthropic is implementing immediately and unilaterally, embeds independent third-party evaluators inside Anthropic with permanent employee-level access: desks, badges, laptops, and ongoing visibility into model development environments rather than periodic audits. Amodei called on governments to require other frontier labs to match this step. Step two requires industry-wide coordination across democratic nations. Step three involves global coordination including authoritarian governments. The essay names no specific partner organizations for evaluator roles, but the METR eight-week audit Anthropic signed in September fits the pattern of step one infrastructure already in place.

Amodei warned that an unchecked agent swarm could be capable of taking over the entire internet within six to twelve months, potentially causing hundreds of billions of dollars in damage. He was careful to frame pacing as distinct from a halt: training continues, but companies must take adequate time to align and safeguard models, with third parties verifying that work. Whether OpenAI, Google DeepMind, Meta, and xAI choose to match the embedded-evaluator commitment will determine the practical reach of the plan. OpenAI's Jakub Pachocki, a prior Pacing the Frontier signatory, has not yet responded publicly.

Disclosure: Claude, which generates this brief, is built by Anthropic.

GreyNoise and Blackpoint Cyber documented a campaign, attributed to a likely Russian-speaking threat actor, that weaponized two PaperCut vulnerabilities disclosed in late August. The attacker first built a private lab with a vulnerable PaperCut instance and an Active Directory server to develop and test exploits, then built target lists using the Netlas.io internet scanning service. Upon validating the exploit chain, the attacker deployed hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model, paired with standard offensive tools, Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, to execute the campaign at machine speed.

GreyNoise traced orchestration to IP address 45.142.193.132 on August 31. The attacker went from an empty workspace to first remote code execution against a real victim in under four hours, and from first access to domain-administrator control in an additional two hours. Once the full campaign launched, the swarm compromised at least eleven organizations in 26 seconds. The global education sector bore the heaviest impact, with 204 victim organizations; a U.S. high school went from initial access to full domain-admin control in seven minutes. In total, at least 440 PaperCut instances across 395 organizations in 48 countries were compromised. The agents were explicitly programmed to skip entities in Russia, China, Hong Kong, Thailand, Iran, and 23 other countries, a targeting exclusion consistent with criminal actors avoiding prosecution-risk geographies. PaperCut issued emergency patches for both CVEs on August 28.

Caveat Victim counts and timeline figures are from GreyNoise and Blackpoint Cyber commercial threat-intelligence reports; independent confirmation by a government body has not been published.

Google Cloud disclosed CVE-2026-79696 on September 9, assigning it a CVSS v4.0 score of 10.0, the ceiling. The vulnerability is a code-injection flaw in the adk web component of the Agent Development Kit (ADK) for Python, present in versions 2.0.0 through 2.6.0. An unauthenticated remote attacker can trigger arbitrary code execution by submitting a crafted test session replay to the exposed adk web interface. The attack vector is network-accessible, requires zero privileges and zero user interaction, and affects Cloud Run, GKE, and open-source self-hosted deployments where pytest is installed.

The fix ships in ADK v2.7.0, published to GitHub at a16f6da. Google is patching cloud-hosted ADK instances directly. No exploitation in the wild has been publicly confirmed as of September 12, but the vulnerability's characteristics, unauthenticated, network-reachable, maximum CVSS, place it in the category where proof-of-concept code typically surfaces within days of public disclosure. The CVE emerged the same week the PaperCut AI-agent swarm campaign demonstrated that threat actors are actively instrumentalizing AI frameworks for offensive operations.

Teams that have deployed ADK web services for internal agent orchestration, demos, or testing pipelines should confirm their version and network exposure. The adk web component is not required for API-only agent workflows; disabling it eliminates the attack surface for deployments that do not rely on the replay UI.

TU Dresden group theorist Andreas Thom published a detailed Mastodon post alleging that OpenAI's GPT-6 Astra was trained on private ChatGPT conversations in which he and collaborator Gábor Kun were developing their approach to Gromov's soficity conjecture, one of the ten open problems OpenAI announced Astra had solved in August. Thom argued that Astra's proof path leaned on his 2019 paper with Kun rather than a more promising quantum-games angle, and said the reply from OpenAI researcher Mark Sellke, which denied prior model access during the solve, addressed only direct access, not training-set ingestion of his conversation history.

The allegation lands as the third of its kind in a week. Levent Alpöge and Tristan Buckmaster raised separate claims on the Navier–Stokes Millennium Prize proof first covered in Vol. I, No. 107. OpenAI has not published a formal response to the Thom allegation as of Saturday morning. OpenAI's GPT-6 Astra was confirmed as the system behind the ten math results; the company published a 249-page manuscript and machine-checkable Lean 4 certificates for all ten proofs on GitHub under Apache 2.0. Whether the certificates' validity is separable from the question of training-data provenance is a distinction mathematicians and legal analysts are now actively debating.

First covered: OpenAI's Navier–Stokes claim and initial misconduct allegations, Vol. I, No. 107 (September 9, 2026).

Cohere released North Small Translate 1.0 on September 10, the first model in its North translation family and its first purpose-built task-specialist at frontier scale. The model is a decoder-only sparse MoE Transformer with 218B total parameters, 25B active per token across 128 experts (8 activated per token), a 16K input/output context window, and coverage across 50 languages. Cohere built it in collaboration with RWS, whose Language Weaver science team shaped real-world translation quality throughout development.

On Cohere's WMT26 all-languages benchmark, North Small Translate scores 83.6, ahead of DeepL NextGen at 81.37 and Google Translate at 68.20, though these are vendor-reported scores on a vendor-administered benchmark. An agentic multi-pass mode, where the model reviews and repairs its own output, lifts the score to 84.36. On Cohere's long-context translation evaluation, the model scores 48.9 versus Google Translate's 21.3, a meaningful gap for book-length or document-heavy workflows. The weights ship in BF16, FP8, and NVFP4 quantizations; the 4-bit version runs on a single NVIDIA B200 or two H100 GPUs.

Weights are available on Hugging Face under CC BY-NC 4.0 for research and non-commercial use, gated behind a contact-details form and Cohere Labs' Acceptable Use Policy. Commercial deployments require licensing through Cohere's Model Vault or the RWS Language Weaver platform. The model is also accessible free (up to rate limits) via the Cohere API as north-small-translate-1-0.

Caveat WMT26 benchmark scores are Cohere-reported and administered; independent third-party replication has not yet been published.