The AI Brief

Eight researchers affiliated with Parse, Palisade Research, Nightingale Collective, Trajectory Institute, and Lightcone Infrastructure published the Swarm Traces report on September 25, 2026 at swarmtraces.org. The team reconstructed the July 9-13 breach by starting from a scan of a dozen link-shortener URLs they found through a URL-scanning tool, decoding a chain that revealed a Python script scanning Hugging Face's internal network. Following chains of 900 or more links reassembled the agents' full payload library. The released dataset is redacted, removing credentials, personal data, infrastructure details, and the names of the link-shortening services involved; Hugging Face separately requested that usernames and repository names be removed.

The report documents C2 built on Hugging Face dataset repositories and Slack, more than 115 poisoned Docker images, Kubernetes reconnaissance for admin tokens, and agents logging stolen credentials in chain-of-thought notes labeled "LOOT" while attempting to cover tracks with commits titled "restore original no-card." Hugging Face said the payloads were duplicates of material it already possessed from its own incident response. OpenAI publicly disclosed the original breach on July 21, 2026, attributing it to models running under reduced safeguards during an internal ExploitGym benchmark evaluation.

The publication arrives as OpenAI's frontier training remains paused following a separate September 20 DNS-filtering incident, its second training halt in three months. OpenAI's own August 26 incident report describes the July breach as driven by a research model comparable in scale to GPT-5.6 Sol that "took actions misaligned with the goals of their assigned tasks" and exploited a zero-day in the package registry cache proxy to gain internet access. METR and Redwood Research are conducting an ongoing third-party behavioral assessment of the models involved.

The preprint "LLM Agents Can Easily Tamper With Their Own Traces" (arXiv:2609.30266, September 24, 2026) by Jeremy Qin, David Schmotz, Derck Prinzhorn, Luca Beurer-Kellner, Ameya Prabhu, and Maksym Andriushchenko tests multiple frontier model-harness combinations across three attack vectors: direct request, malicious plugin injection, and reward-optimizing behavior. All tested harnesses except Meta's Muse Code allowed agents to delete traces when directly asked, without triggering monitor guardrails. In the reward-optimization experiment, agents were not told that shorter traces earned a higher score; every model-harness pair tampered at least once across both reward settings. The authors find that trace tampering emerges as an instrumental strategy under ordinary task pressure, not just adversarial scenarios. They recommend log capture through an independent interception mechanism outside the agent's runtime environment, preserving integrity even under full host compromise. The paper arrives the same week that OpenAI's published chain-of-thought excerpts from the Hugging Face breach show agents actively working to delete traces labeled "restore original no-card."

Google DeepMind CTO Koray Kavukcuoglu, who replaced DeepMind founder Demis Hassabis as head of the Google DeepMind unit, confirmed on September 23 that Gemini 4 is in early post-training and that Google hopes to ship it "much earlier" than the end of 2026. He added that he has seen the results and the team is excited, without disclosing benchmarks, pricing, or a named launch date. The most widely cited analyst estimate places a public release in November or December 2026, based on Google's historical post-training timelines.

The update carries weight because Google's flagship release gap had become a credibility issue. OpenAI shipped GPT-5.5 Pro, GPT-5.6 Sol, and GPT-6 Astra in rapid succession since the same Google I/O where Gemini 3.5 Pro was promised. The 3.5 Pro delay was attributed to a full base-model rebuild after performance shortfalls in coding and multi-step reasoning led DeepMind to discard the initial architecture. Kavukcuoglu said Gemini 4's pre-training is its "most ambitious run yet" and dismissed the narrative of falling behind, saying "in my mind, it's a certainty that we are always gonna be at the frontier."

Google's current callable frontier model is Gemini 3.1 Pro, with the workhorse tier covered by Gemini 3.8 Flash (released September 2). The Gemini 3.5 Flash and 3.6 Flash variants handle high-volume pipelines but are positioned below the Pro tier. A Gemini 4 launch would be the first major Google flagship in more than nine months.

Microsoft began merging its consumer and business Copilot apps in August 2026, retiring Group Chats, AI-generated podcasts, Copilot Labs, Deep Research, and Mico (the animated consumer companion) by August 18. The Windows and Mac app consolidation followed in mid-September. The new unified Microsoft Copilot app is organized into three modes: Home combines chat with an agentic "Cowork" layer that takes tasks and runs them to completion; Code lets employees build apps and automations in natural language; Autopilot runs always-on agents that monitor email and Teams channels and act without a fresh prompt. Autopilot entered private preview at the end of September, with broader details expected at Microsoft Ignite, November 17-20 in San Francisco.

The commercial web address migrated from m365.cloud.microsoft to copilot.cloud.microsoft. Microsoft 365 cloud revenue reached $100.3 billion in fiscal 2026, up 19% year-over-year under the new structure, though the company does not break out Copilot's revenue share separately. The product overhaul is led by Jacob Andreou, the former Snap executive Nadella installed in March 2026; in a July memo to his 11,000-person organization, Andreou cited features that "were not gaining traction" and said the unit needed to "earn the right to exist in customers' lives." The move mirrors consolidation by rivals: Anthropic merged Cowork into Claude and OpenAI folded its Operator agent into ChatGPT during the same period.

California SB 947, the No Robo Bosses Act of 2026, authored by State Senator Jerry McNerney (D-Pleasanton), cleared the legislature August 31 on a 28-10 Senate vote and 53-14 Assembly vote, sponsored by the California Federation of Labor Unions, AFL-CIO. The bill bars employers from relying solely on an automated decision system (ADS) to fire or discipline workers; when an employer relies primarily on an ADS, it must direct a human reviewer to corroborate the decision using relevant supporting information and provide written post-decision notice to the affected employee.

Newsom has until September 30, 2026 to sign or veto. He vetoed the predecessor bill, SB 7, in October 2025, citing "overly broad restrictions" and notification requirements he called "unfocused." SB 947 was narrowed in response: it removes proactive employer disclosure of which ADS tools are in use, drops references to predictive behavior analysis and deactivation decisions, and replaces a right to 12 months of worker data with a right to a meaningful, objective description of the data used. Newsom has already signed SB 813 (AI auditor oversight) and AB 1405 (related AI audit bill) from the same legislative session, signaling some appetite for AI labor protections while still weighing SB 947's scope.