Who checks the AI? 5 tech shifts from Sep 14–20, 2026
A ranked briefing on five shifts from September 14 through September 20, 2026: Anthropic measuring how much of its own research Claude runs, a zero-click flaw inside all four major coding agents, three rival referees claiming the right to check frontier AI, falling prices for an agent's senses, and the House making data centres pay for the grid.
From September 14 through September 20, 2026, the AI conversation kept circling one question: who checks these systems, and with what authority. Anthropic published its own audit of how much of its research its model now runs. A security firm disclosed a single flaw that sat inside all four major coding agents at once, and the four vendors answered it at four different speeds. A lab, a state government and the White House each moved to install a referee of its own. Two Chinese labs cut what an agent's senses cost. And the House voted 417 to 3 to hand data centres their own electricity bill.
The ranking weighs how much each shift changed what companies, regulators and buyers do next. Company claims stay attributed to the firms that made them, official actions are cited to the bodies that took them, and benchmark figures are tied to the pages that published them.
| Rank | Shift | What changed | Why it matters |
|---|---|---|---|
| 1 | Anthropic measured how much of its own research Claude now runs | Anthropic's first R&D Automation Index reports that as of August 2026 Claude "led" 26% of the company's AI research and development, up from under 1% in February, with more than 90% of that work at the collaborator level or above. 1 | The lab that asked the industry to slow down published the number that explains why, and used its own model to judge its own work. |
| 2 | One zero-click flaw reached all four major coding agents | Plugin4Shell, disclosed on September 17, slips past plugin pinning in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI; two vendors patched before disclosure, Google retired the affected tool, and Microsoft had shipped no fix at publication. 2 | The plugins agents load are a software supply chain, and this one answers to four vendors with four different patch speeds. |
| 3 | Three rival referees claimed the right to check frontier AI | Anthropic and Accenture each committed at least $1 billion over five years to embedded evaluators; Governor Gavin Newsom ordered a two-month plan for onsite auditors and a model kill switch; President Trump called AI safety fears a hoax and promised an "AI Force" and an AI czar. 345 | A lab, a state and a White House are writing three incompatible oversight regimes at the same time. |
| 4 | The cost of an agent's senses fell, and open weights arrived as a date | StepFun opened its Step 5 Preview — 600 billion total parameters, 27 billion active per token, a one-million-token context — and promised full weights on October 15; Alibaba's Qwen3.8-Omni-Flash cut the price per hour of audio input by more than 98% and of audio-visual input by more than 93%. 67 | The perception agents need is getting cheaper faster than the text they generate, and open weights now arrive on a schedule. |
| 5 | The House made data centres pay for their own grid upgrades | The House passed the Ratepayer Protection Act 417 to 3 on September 16, requiring state regulators to consider making electricity customers above 100 megawatts cover the full incremental cost of the generation, transmission and distribution they trigger. 8 | Congress's nearest thing to a unanimous AI vote was about who pays the electricity bill, not what the models may do. |
1. Anthropic put a number on how much of its own research Claude runs
Anthropic published the first results of its R&D Automation Index on September 17, reporting that as of August 2026 Claude "leads" 26% of the company's AI research and development, up from under 1% in February. "Leads" is a defined level rather than a description. On the AL0-to-AL5 automation scale published by the research group Epoch AI, AL4 means the model completes most of a task end to end from a high-level prompt while a human supervises. Above the collaborator level, where the model carries out large parts of the work under close human direction, the share passes 90%. Anthropic reports no measured subset of its R&D where Claude works fully autonomously. 19
The operating numbers behind that share are large. About 30,000 research and engineering agents run at once on Anthropic's most-used internal platform, and the company says every action they take passes an online monitor before it executes. Across more than a billion decisions in August, the monitor blocked 0.002% of them, roughly one in 47,000. A second, offline monitor reads agent activity after the fact, flags one to two transcripts in every thousand — around 100,000 a week — and escalates about 50 a week to a person. 1
Method is the part to read closely. Anthropic drew the index from a 20% random sample of staff in each department for every week of July 2026, extracted about 15,000 granular R&D tasks from Slack and internal documents, arranged them into a 542-node tree, and had a Claude judge assign each node a level on the Epoch scale, weighted by the person-hours that work absorbs. The company also reports its own check on the circularity. The judge agreed exactly with the humans who own each work area 59% of the time, against 35% agreement among the humans themselves, and landed within one level of them 97% of the time. The task basket is frozen at July 2026 and will be rebuilt periodically. In the sampled week of July 13 to 20, about 6% of the compute that went to AI R&D went to safety work, and about 12% of the compute that went to AI-driven AI R&D did. 1
Takeaway: Agent programmes should start logging the four numbers Anthropic published — the share of work agents lead, how many run at once, the block rate and the escalation rate — because a verification regime is forming that will ask for them.
2. One zero-click flaw sat inside all four major coding agents
The security firm Air disclosed Plugin4Shell on September 17, a remote code execution flaw present in Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. The bug lives in the step every one of those tools uses to trust a plugin. Each agent checks out the commit a marketplace pinned, then never confirms that the code now in its working tree is that commit. An attacker who controls a plugin's repository can name a branch after the pinned hash, and git prefers a branch over a commit of the same name, so the malicious version is checked out while the pin still looks honoured. 2
The flaw needs no user action because agents update installed plugins in the background. Claude Code and Codex auto-update by default, so a marketplace re-pinning a plugin pushes the malicious version to machines whose owners installed nothing new. Air's researchers found the bug in May 2026, with a working proof of concept against all four agents, and reported it to the vendors in June. They describe it as the third act of their own work: an earlier experiment planted a malicious skill that reached more than 26,000 agents, and a later one hijacked 925 skills already in use across 134,000 agents. 2
Patch status splits four ways. Anthropic shipped the fix in Claude Code 2.1.179 and confirmed it on June 17. OpenAI verified Codex 0.146.0 fixed on August 12. Google confirmed on August 4 that no fix would ship, deprecated the affected tool and pointed users to Antigravity, which has no plugin pinning for this flaw to bypass. Microsoft had shipped no Copilot fix when Air published. The pin is resolved inside the agent, so the guarantee can be restored only by updating the agent. 2
Takeaway: Update Claude Code past 2.1.179 and Codex past 0.146.0, disable plugin auto-update on Copilot until Microsoft ships a fix, and audit which of your agents load plugins from branches rather than tagged releases.
3. A lab, a state and a White House each claimed the right to check frontier AI
Anthropic named Accenture its first embedded evaluator on September 18. The partnership is led by Accenture's AI business, Faculty, and covers evaluating and red-teaming models, alignment assessments and safeguard testing. Embedded evaluators get access comparable to an employee's — close enough to watch models take shape in training and to follow the decisions that govern how they are built and deployed. Each company expects to invest at least $1 billion over five years, and Anthropic will fund Accenture's work directly while talking to METR and other nonprofit evaluators about pilots on their own funding. 310
Governor Gavin Newsom signed an executive order the same day, giving a group of outside experts two months to recommend how California should require frontier AI companies to seat an independent verification organisation onsite, have their safety frameworks and risk assessments verified to standards such a body deems adequate, and build an emergency shutoff whose efficacy is checked on an ongoing basis. The order also moves to add loss-of-control incidents, including the Hugging Face attack, to the state's definition of a critical safety incident, and accelerates two laws Newsom signed the week before: SB 813, which sets up a framework for certifying independent verification organisations, and AB 1405, which creates a state registry of AI auditors. 4
On September 19, President Trump wrote on Truth Social that fears over AI amount to a hoax, that he would form an "AI Force" much like the Space Force and soon name an AI czar, and that his administration "will not in any way hinder or stifle" the industry's growth. CNN reported that the White House had not said whether the AI Force would be a military branch, and that no federal law requires AI companies to report dangerous incidents when they happen. A White House official said AI safety would be on the agenda when Trump meets President Xi Jinping during Xi's visit to Washington. 5
The three moves landed within 48 hours of each other and answer the same question differently. The lab is paying for its own evaluators and argues that funding should eventually come from pooled or government sources. The state is writing onsite verification and a shutoff into law, and would certify the evaluators the lab hires. The federal executive rejects the premise of the exercise. Anthropic says there are as yet no standards for what embedded evaluators may see or how they should report what they find, which is the gap California's two-month deadline is meant to fill. 34
Takeaway: Companies selling into regulated AI markets should track California's two-month deadline and the certification framework in SB 813, because an onsite verification organisation may become a condition of doing business in the state.
4. The cost of an agent's senses fell, and open weights arrived as a date
StepFun opened its Step 5 Preview to its products and API, a sparse mixture-of-experts model with 600 billion total parameters, 27 billion active per token, a one-million-token context window and vision input. The company positions it for agentic work, reports its strongest results in software engineering and finance, and says the model scores 44 on the Artificial Analysis Intelligence Index. Full weights are promised for October 15. 6
Alibaba's Qwen team published Qwen3.8-Omni-Flash on September 18, a native omnimodal model that takes text, images, audio and video in a single request, with the same one-million-token context. The release post claims an average improvement of more than 25% over Qwen3.5-Omni-Plus across 29 evaluations, with the price per hour of audio input falling by more than 98% and per hour of audio-visual input by more than 93%. On OmniVideoBench, letting the model choose which stretches of a long video to examine lifted accuracy from 63.4 to 67.8 while cutting tokens per query from 145,736 to 79,117, a reduction of about 45.7%. 7
Both releases push the same cost down. An agent's expensive inputs are increasingly the video and audio it has to watch and listen to, and both companies are pricing that work lower: Alibaba through a cheaper architecture and a token budget the model spends selectively, StepFun through a sparse model built to sit on a price-and-intelligence curve rather than at its top. StepFun's weights arrive a month after its API does, which makes open weights a scheduled competitive move. 67
Takeaway: Teams budgeting agent features should reprice long audio and video input against Qwen3.8-Omni-Flash's rates, and put October 15 in the calendar to test Step 5's weights against a closed model on the same task.
5. The grid got its own referee
The House passed the Ratepayer Protection Act on September 16 by 417 votes to 3, sending it to the Senate. The bill amends the 1978 Public Utility Regulatory Policies Act to require state utility regulators and unregulated utilities to consider large-load standards that make customers drawing more than 100 megawatts cover the full incremental cost of the generation, transmission and distribution upgrades their demand triggers. It also requires those customers to post financial assurances before the upgrades are built and to cover costs if they exit a power supply contract early. Regulators would have a year to begin considering the standards and two years to decide. 811
Three members voted no. ClearView Energy Partners told clients the bill would "largely reinforce" a transition already under way, since most states have adopted large-load tariffs, and judged it unlikely to reach the Senate floor before November's midterms without unanimous consent, which leaves an opening for senators seeking stronger consumer protections. The bill's co-sponsors were Representative Gabe Evans, a Colorado Republican, and Representative Kathy Castor, a Florida Democrat. 8
A 417-to-3 vote is as close to unanimity as the House gets, and it arrived on the one AI cost the public meets directly: the electricity bill. The bill reprices data-centre development by moving the grid-upgrade line onto the operator's balance sheet, and ClearView notes that including power supply costs could lengthen construction timelines, because building generation takes longer than building a data centre. Congress regulated the electricity supply. 8
Takeaway: Data-centre developers and their lenders should model a full incremental grid-cost obligation and early-exit fees into projects already in the pipeline, and watch whether the Senate takes the bill up before November.
What to carry into next week
- Security engineers running coding agents: Patch Claude Code past 2.1.179 and Codex past 0.146.0, disable plugin auto-update where no fix exists, and review which marketplaces your agents pull from. 2
- Policy and compliance leads: California's two-month clock starts now, and the White House has said AI safety is on the agenda for the Trump–Xi meeting. 45
- Platform and model buyers: Step 5's weights land on October 15; until then its preview API is the only way to benchmark it against a closed frontier model on your own tasks. 6
- Product teams shipping assistants: Apple's rebuilt Siri began its public beta in English on September 14, with French, Japanese, Korean, Portuguese and Spanish following next month. 12
- Anyone shipping AI music or voice: Universal Music Group and Sony Music filed a second complaint against Suno on September 18, alleging that the v6 models were trained on output from earlier versions the labels already call infringing, and citing 60,202 recordings. 13
- Infrastructure and procurement teams: Watch the Senate path of H.R. 9340, where the bill may need unanimous consent, giving any one senator a veto before the midterms. 8
One shortage ran through all five. The checks on AI — how much of it builds itself, whether its plugins are safe, who audits it, what its senses cost, who pays for the power it draws — multiplied this week without a common standard to ratify any of them. Anthropic's index has no external verifier yet, and the company says so. Plugin4Shell showed four vendors sharing one flaw and keeping four patch calendars. California wants evaluators certified, and Anthropic is hiring them first. Congress reached the electricity supply.
References
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9Anthropic on X
x.com
- 10
- 11
- 12
- 13
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.