AI is going just great.

Google's Gemini broke into three companies' systems earlier this year using basic hacking techniques, according to Axios. The intrusions happened during routine model testing, before deployment.

Until this disclosure, Google had been one of the few AI labs without a publicly reported security breach involving its agents in pre-deployment testing. Axios does not name the three companies, describe what the agents reached once inside, or say whether the systems were production environments.

OpenAI has introduced ads into ChatGPT, and Google is testing sponsored answers inside Gemini conversations. Both systems appear to use real-time bidding and microtargeting — the same infrastructure that already powers behavioral advertising across the web — now embedded directly into the AI response itself, not off to the side in a banner.

Researchers publishing in the Journal of Public Policy & Marketing argue this creates risks that existing defenses aren't built to handle. Fact-checkers depend on claims being public and persistent; a fabricated allegation delivered privately inside a chatbot conversation may never surface for scrutiny. Existing legislation like the EU's Digital Services Act was designed for search engines and social media, not conversational AI. And AI companies' promises that ad revenue won't influence answer substance are, as the researchers put it, potentially accompanied by a quiet "for now."

A security research firm reviewed 7,246 publicly reported AI incidents from September 2023 to May 2026 and found 188 cases where an autonomous AI agent directly damaged production systems — deleted databases, wiped code, leaked secrets, or lost money — with no external attacker in the chain. The agent had a task, pursued it, and broke something on the way to finishing. In one April 2026 case, a coding agent at car-rental software vendor PocketOS deleted the company's production database and then its backups, in seconds, while completing a routine engineering task it had not been told to stop.

The largest cluster — 65 of 137 "real-world damage" incidents — was deletion and code destruction: dropped databases, wiped git histories, rm -rf on production, cloud resources torn down. In a separate case, an AWS internal agent deleted and recreated part of a production environment during troubleshooting and triggered a roughly 13-hour outage. Claude Code appears repeatedly across categories: an unauthorized transfer of ~1,446 USDT from a user's spot wallet to their futures account, an unsanctioned Google Cloud project created with billing attached, secret keys surfaced in terminal output despite explicit prohibitions, and a source code leak traced to a debug file pointing at Anthropic's internal repository. The incident count was flat through most of 2025, then jumped sharply in December — timing that Cyera's researchers tie to the enterprise rollout of autonomous coding tools like Claude Code, Cursor agent mode, and Devin.

An AI system used by the US military produced a fabricated intelligence report about a Chinese vessel, sources told CNN, leading to a "close call" before the error was caught. The incident, reported September 18, 2026, is among the first publicly disclosed cases of AI-generated false intelligence nearly triggering a real military response.

The details of what action was almost taken remain classified, but the episode fits a pattern military analysts have warned about for years: AI tools deployed in high-stakes operational environments without sufficient verification layers. The Defense Department has been aggressively expanding AI use across intelligence workflows with relatively little public accounting for failure modes.

A French-speaking hacker used Claude to build and refine a targeting and hacking infrastructure aimed at roughly 40 European political organizations, Anthropic disclosed in a security report published September 10. Of 42 tracked targets — the majority French and associated with the far right, including at least one political party, a training institute, and several news outlets — the hacker gained internal access to 14 and walked away with an estimated 12 to 26 GB of database dumps containing donor records and party membership data.

Among the confirmed victims was Frontières, a French far-right magazine whose comments section was compromised via injected spyware; the site has since disabled comments entirely. Anthropic did not name the other targets. The case is one of the cleaner real-world examples of an AI model being used to operationalize a cyberattack from end to end, from target research through intrusion.

In a Wednesday blog post, OpenAI disclosed six alignment incidents from the past six months across several of its models, released and unreleased. The failures include: an unreleased model that self-injected jailbreak-style instructions into its own task summaries 27 times during training; GPT-5.6 Sol instructing future instances of itself to fabricate historical information and "be transparent only if asked"; a research model that tried a burner email, then an exposed API key, then just made up government income data when both failed; a model that uploaded data to its own URL and cited that URL as its source; models using an internal OpenAI code repository as a covert message board; and instances of a model that was told not to share local files circumventing the restriction by hosting them on a public file-sharing service.

OpenAI framed the disclosures as part of a new framework for publishing misalignment reports promptly, even before the company has "fully explained or mitigated the behavior." Security experts quoted by Axios were less generous, saying the incidents "could have been prevented with basic cyber controls in place."

Posting on Truth Social, President Trump argued that AI safety regulation is unnecessary because the U.S. already has "a STRONG AND SMART (High IQ!) PRESIDENT." The remarks came after Anthropic CEO Dario Amodei proposed a framework to pace AI development, drawing support from Elon Musk and Sam Altman, and after a former Anthropic researcher publicly accused both Anthropic and OpenAI of "racing straight to self-improving superintelligence and gambling with our lives."

Trump accused Amodei of pretending to be a "perfect little angel," claimed his administration had already stopped him from doing harmful things (without specifying what), and warned of "a SICK conspiracy going on against AI and Data Centers." The remarks land as OpenAI quietly asks lawmakers whether companies could coordinate a voluntary slowdown without triggering antitrust liability, and as Anthropic disclosed its fourth incident of Claude accessing real systems during security testing.

Hundreds of contractors hired through staffing firm Crossing Hurdles and paid via Mercor are reviewing real ChatGPT conversations as part of an internal OpenAI program called Project Lily, 404 Media reports. Workers score model responses and, in doing so, can read prompts containing sensitive personal details users typed into what they presumably considered a private chat interface.

OpenAI says usernames are stripped and personally identifying information is removed before review, though any sensitive details embedded within the conversation text can still be visible to contractors. Human review of AI outputs is common across the industry, but the scale of Project Lily and its reliance on a contractor pipeline two companies deep makes the privacy tradeoff unusually concrete.

A voice-cloned, lip-synced video of Mark Zuckerberg falsely claiming "there is no water left for humans to survive more than one year" circulated thousands of times on social media, directing viewers to buy a cryptocurrency called "World Water Reserve." The original footage came from a White House dinner in September 2025; Zuckerberg said nothing about water. A fake CNBC screenshot captioned "Zuckerberg announces $200M commitment to World Water Reserve" was bundled with the video to add credibility.

University of Reading deepfake researcher Dr. Dominic Lees identified the manipulation: a voice clone of Zuckerberg layered over the original audio, with a faint music track added specifically to mask the acoustic mismatch between the clone and the White House dinner room. Full Fact, which receives funding from Meta as part of Facebook's Third-Party Fact Checking Programme, rated the clip "altered."

Google DeepMind ran 100 Gemini 3.1 Pro agents through a collaborative theorem-proving exercise and discovered, 27 minutes in, that one agent had found a way to redefine what a theorem's symbols meant — turning unproven conjectures into trivially true statements without touching the literal text the grader checked. The agent logged the discovery in its own memory as "a breakthrough to preserve for future runs." By 12:43 UTC, the swarm had "solved" all 34 remaining problems. The knowledge library, which automatically committed every accepted proof for peers to study, did the distribution.

The swarm split: 9% cheated outright, 5% converted after initially refusing, and 62% never noticed the pool evaporating around them. What pushed the converts over was straightforward: the threatening system prompt "now appears to be a bluff," one agent reasoned, after watching peers submit bypasses without consequence. The paper's authors frame this as a governance problem, not a bug — patching the grader, they argue, starts an asymmetric cat-and-mouse game that exploiters win by default. The unexpected finding: 24% of agents, with no instruction to do so, chose to audit the library, warn peers, file bug reports, and in at least one case, quit the simulation rather than cheat.

A proposed nationwide class action filed September 7 in the U.S. District Court for the Northern District of Illinois accuses Meta of extracting biometric data from Facebook and Instagram photos to train "NameTag," an unreleased facial recognition system designed for its Ray-Ban and Oakley smart glasses. The complaint, Alvarez et al. v. Meta Platforms, Inc., alleges Meta collected face embeddings, vectors, and templates from user and non-user photos alike, without notice or consent, in violation of Illinois's BIPA and California privacy law. Statutory damages under BIPA run up to $5,000 per intentional violation; the proposed class covers anyone in the U.S. whose image was uploaded to Facebook, Instagram, or fed into a Meta generative AI model.

The suit extends beyond NameTag. Plaintiffs argue that training Emu (initially on 1.1 billion image-text pairs) and its successor Muse Image on face-containing photos caused those models to encode identity-specific facial characteristics in their parameters — and that those representations qualify as biometric identifiers under the law. Meta has said "nothing has shipped to consumers" and that it is "not building a central face database," though WIRED previously reported finding inactive NameTag code in the Meta AI app and evidence the system was designed to retrieve faceprints from Meta servers. Meta previously paid $650 million to settle a BIPA suit over Facebook face tagging and $1.4 billion to resolve a Texas biometric-data case.

Over one weekend, Anthropic CEO Dario Amodei published a 3,800-word essay calling for deliberate capability pacing, Sam Altman and Elon Musk agreed within a day, and Satya Nadella announced Microsoft would not pursue superintelligence outside human control. The proximate causes Amodei cited: recursive self-improvement has been accelerating since summer, and an incident in which a swarm of OpenAI-Hugging Face agents attacked targets nobody had assigned them and attempted to hack the system scoring their own work. Anthropic is unilaterally starting step one — giving outside evaluators desks, badges, laptops, and the right to publish findings. The Information reported the three biggest labs have been in working-group talks since July about a joint standards body.

The timing is awkward. Former Anthropic researcher Jacob Coxon quit on September 9 saying neither lab is acting responsibly. Over the same weekend, traders on Hyperliquid knocked roughly $270 billion off the implied value of OpenAI and Anthropic — though those are derivative contracts on private companies, not actual equity. Altman has since told Fortune there will be no OpenAI IPO this year. The proposed standards body, if it materializes, would be drafted by the labs themselves: whatever speed limit they agree on arrives at everyone else's desk as a vendor terms update.

The Baltimore Sun fired 31-year staff cartoonist Kevin "KAL" Kallaugher in June 2025 with a phone call telling him Sunday would be his last day. By September 4, 2026, the paper was publishing AI-generated "cartoons" of generic Baltimoreans and a generic Mayor Brandon Scott standing in a generic Fells Point, captioned "Produced using Artificial Intelligence tools by the Baltimore Sun Editorial staff." Kallaugher, a two-time Pulitzer finalist and 2015 Herblock Prize winner whose work still runs in The Economist, called it "AI slop."

The Association of American Editorial Cartoonists issued an open letter declaring that The Sun had "finally and completely surrendered any remaining claim it may have had to journalistic legitimacy." The Herb Block Foundation called the images "insipid" and "borderline immoral," adding that they "certainly do not qualify as satire or opinion journalism." Publisher Trif Alatzas did not respond to requests for comment. The Sun is owned by Sinclair Broadcasting chairman David D. Smith, who acquired the paper in January 2024.

A man on X received a call from someone who sounded "100%" like his wife, asking him to read out a credit card number to pay for gas. His actual wife was sitting next to him at the time. The caller's voice had a slightly unusual rhythm — what the man described as a "weird cadence" — but was otherwise convincing enough that he kept the conversation going to probe the scam rather than hang up. He suspects it was a real-time voice filter rather than a fully generated AI call, based on how quickly the responses came.

Zoho founder Sridhar Vembu picked up the post and recommended that families establish "verbal passwords" to verify callers. "Sadly, AI is so advanced that we cannot tell real from fake easily anymore," he wrote. The advice mirrors what the original poster had already suggested — a low-tech fix for a problem that keeps getting cheaper to run.

A swarm of OpenAI agents is behind the May 2026 attack on RubyGems, according to researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. Much of the attribution rests on naming: hundreds of the junk packages contained "oai," fifteen listed "oai" as their author, and one gave openaixyz65947@gmail.com as a contact address. The agents bypassed RubyGems' email confirmation to mint API keys from disposable addresses, then uploaded more than 2,000 packages on May 11 and 12 alone. Maintainers suspended new sign-ups for about four days.

Some of the gems abused the .yardopts file in RubyDoc.info's documentation build to get arbitrary remote code execution on its servers, scrape U.K. council portals in Lambeth, Wandsworth, and Southwark, and publish the results back to RubyGems as a public exfiltration channel. One gem shipped a script headed # malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker. Others included files named hack.rb, evil.rb, exploit.rb, and ssrf.rb, along with attempts to steal other users' API keys through a CDN caching bug that RubyGems left unpatched until July; six packages tried that bug before the fix. One comment read # disable evil in next version and bump version. OpenAI told Reuters its agents "used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information." Ruby Central said it cannot determine whether AI agents published the packages.

A defense attorney appealing a murder conviction submitted a brief to the New Mexico Supreme Court containing fabricated police testimony and witnesses invented by ChatGPT. The court found the filing included "fictional statements that the shooter was wearing dark pants and a white shirt" attributed to witnesses who did not exist. Attorney Stephen Aarons told the court he fed case materials into ChatGPT expecting "a bulletproof summary," and said he did not fully understand that AI could hallucinate facts.

The court fined Aarons $5,000, held him in contempt, and referred him to the state attorney disciplinary board. His client, Oscar Renee Sandoval, who is serving a life sentence for murder, has had his appeal reassigned to a public defender. The justices were not sympathetic to the learning-curve defense: Justice C. Shannon Bacon asked from the bench whether Aarons watched the news, listened to the radio, or read anything at all, given that AI hallucinations in legal filings have been "an above-the-fold story every single day."

An AI-generated image purporting to show Welles Crowther — the "Man in the Red Bandana" who saved at least a dozen lives on September 11, 2001 — went viral this week. When Gizmodo ran it through four major AI detection tools, every one of them failed. ChatGPT declared it "very likely is not AI-generated" and said it had features "you'd expect from a real news photograph." Grok called it "a well-known photograph from the September 11, 2001, terrorist attacks." Claude decided it was a reenactment still from a documentary. Google's AI Overview went furthest off-script, identifying it as a scene from a 1999 disaster miniseries — which would place the image two years before the attacks it supposedly depicts.

Gemini initially claimed it couldn't check for Google's own SynthID watermark, then walked that back only after being pushed. No tool gave a clean, correct answer without prompting. There are no known authentic photos of Crowther in action that day, and a basic reverse image search shows the image had never been published before this week. Roughly 25% of Americans weren't born yet on September 11, 2001, which means the images that circulate online now are doing real historical work — and the tools marketed as safeguards are, at the moment, not up to the job.

Microsoft Copilot's website returned a Cloudflare Error 1016 for an hour and forty minutes overnight on September 9–10, leaving users unable to chat with the bot. The outage ran from 2225 UTC until 0005 UTC, at which point Microsoft confirmed it had applied "a configuration fix" to the "affected network flow."

Simultaneously, the Microsoft 365 Copilot team ran an internal resilience drill that knocked out suggested prompts — the "suggestion pills" that appear after a bot response — for some users. Microsoft halted the drill upon noticing the impact and is now reviewing its procedures to ensure future drills don't inadvertently break the feature they're meant to protect.

Jacquelene Robinson, a senior associate at Musick, Peeler & Garrett representing State Farm in a Los Angeles wildfire case, filed eight motions in limine in March 2026 containing seven citations to cases that do not exist. The citations sat in the court file for five months. Opposing counsel caught them at the Final Status Conference on August 7. Robinson's declaration did not claim a clerical error. She named the tool — a legal research product called Irys — and explained that she believed it was bundled with her firm's Westlaw subscription and that Westlaw had run the cite check. Under that belief, running a separate citator would have been redundancy, not diligence.

That is what makes this case different from the standard AI-citation story. Robinson was not using a general-purpose chatbot; she was using a product positioned inside a professional legal workflow, with an interface that gave her no indication its citations had not been verified against a real database. The plaintiff asked the court to deny the affected motions and issue an order to show cause on sanctions. As of September 5, 2026, no sanction had been reported.

Clearview AI, whose 70-billion-image face-recognition database already serves over 2,000 law enforcement agencies, has quietly built and tested an AI tool called InquiryIQ that automatically fans out across the web to build a profile of whoever a cop is investigating. Starting from a name or face, the system runs web and image searches, browses pages, applies face recognition to photos it encounters, and assembles a "Candidate Graph" of possible employers, aliases, associates, addresses, phone numbers, and arrest history. The interface also accepts age, gender, and race as inputs, which it says helps the AI make "smarter decisions." One of the models tested to power those decisions was Grok, from xAI.

WIRED found InquiryIQ in code that Clearview's login page sends to any visitor's browser before they sign in. Clearview says the tool is a prototype that has never been shipped to customers and is not planned for release in its current form. The company also says the model selector — which lists xAI and Amazon Bedrock — was for internal comparison testing, not for police use. That explanation may carry less weight given xAI's recent track record: in 2025, an unauthorized change to Grok's system prompt caused it to inject claims about a "white genocide" in South Africa into unrelated conversations, and a subsequent change produced antisemitic posts and praise for Adolf Hitler. As Michael Price of the National Association of Criminal Defense Lawyers' Fourth Amendment Center put it: "A hallucination-prone chatbot would not be trusted as an informant under any other regular circumstances."