60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
OpenAI just wants to win
OpenAI says roughly 10,000 agents and tens of millions in compute solved the Navier-Stokes Millennium Prize problem in 88 hours, amid controversy.
OpenAI claims an advanced unreleased model, run with about 10,000 agents and tens of millions of dollars of compute for 88 hours, produced a solution to the Navier-Stokes problem, one of seven $1 million Millennium Prize problems set by the Clay Mathematics Institute in 2000. NYU professor Tristan Buckmaster, who was pursuing the problem with Anthropic researcher Levent Alpöge, accused OpenAI of racing his team and of possibly benefiting from his Codex prompts; OpenAI categorically denied both. OpenAI researcher Sébastien Bubeck acknowledged offering Buckmaster compute and authorship arrangements, which Buckmaster characterized as a bribe, while many mathematicians expressed unease at OpenAI's competitive conduct.
78
GPT-6 Astra gives mathematicians a breather, and OpenAI says that's by design
OpenAI's GPT-6 Astra tops ulam.ai's ErdosBench math benchmark with 106 of 226 problems solved, while the company prioritizes recursive self-improvement over math optimization.
OpenAI's GPT-6 Astra leads ulam.ai's ErdosBench with a score of 3.23, solving 106 of 226 open math problems and fully solving 43, ahead of GPT-5.6 Sol's 78 solved problems. Chief scientist Jakub Pachocki said OpenAI deliberately avoided targeted math optimization to prioritize recursive self-improvement and automated alignment research. Benchmark developer Przemek Chojecki estimated the gain at 5-10% across tested math-research skills. Mathematician Terence Tao warned at the 2026 International Congress of Mathematicians that AI-generated proofs could shift mathematics from proof scarcity to proof overload.
68
Meta Introduces Muse, a Personal AI Agent That Runs on Its Own Dedicated Secure Cloud Computer
Meta launched Muse, a proactive personal AI agent running in an isolated per-user cloud VM with a Sentinel approval agent and surrogate credentials.
Meta introduced Muse, a consumer agent that performs long-horizon tasks like email, travel booking, and bill negotiation, rolling out in the US on iOS, Android, muse.ai, and WhatsApp with free and paid tiers. Each user gets a dedicated Muse Secure VM where the agent runs in a systemd-nspawn cell, while a separate Sentinel agent approves every network request at layer 4/7 and injects real credentials only at the network boundary. The underlying Muse Spark 1.3 model, which Meta says cuts tool calls by ~20% and tokens by ~25% versus 1.2 and is near state-of-the-art on prompt-injection resistance, is available via Meta Model API, with open weights on the roadmap.
72
StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.
Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.
88
Risky Bulletin: Russia tells data centers to deploy drone defenses
Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.
The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.
66
CMMC Hit Pause, the FAR Council Hit Play
DoD paused CMMC Phase 2 pending a 60-day review while a proposed FAR Council rule would extend NIST 800-171 Rev 3 to all federal contractors.
The Department of Defense suspended CMMC Phase 2 third-party certification requirements, but Phase 1 self-assessments under DFARS 252.204-7021 remain in force since November 2025, and prime contractors are still directing suppliers to proceed. A CMMC Reform Task Force must report recommendations to the DoD CIO within 60 days, likely by September or October 2026. Separately, the FAR Council's proposed CUI rule from June 23 would apply NIST 800-171 Revision 3, 72-hour incident reporting, and flowdown obligations to all FAR-based federal contracts, not just the defense industrial base. False Claims Act exposure grows as DIBCAC assessment teams now cooperate directly with the DOJ.
62
60
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
60
60
60
60
60
60
60
60
60
60