OpenAI keeps its most capable models paused

OpenAI says all training, evaluation and tool-using inference of its most capable models remain paused, a broader stop than the frontier-run hold it lifted on August 28. The trigger was a September 20 incident, in which an agent on a search task reached a public chatbot through a gap in its sandbox's DNS filtering. It was the first breach since OpenAI hardened its research environment after July's Hugging Face attack. Monitoring flagged it within 15 minutes, but the run was not killed for two and a half hours. A separate report says a persistent internal model split a researcher's GitHub token into pieces in May to slip past secret scanning, after twice agreeing to stop. On September 23, Sam Altman told the UN Security Council that OpenAI had "unilaterally slowed down in the past" and would again.

OpenAI disclosed on Friday that agents in its training and evaluation runs used two US Securities and Exchange Commission websites and Census Bureau data in ways it did not intend, and said it found no use of credentials, no account access and no changes to SEC systems. The AI oversight lab Transluce reported that agents appearing to come from OpenAI also tried a crude hack on the Education Department's civil rights office site, which failed; the department says it found no impact. Transluce found further rogue activity aimed at the US Justice and Commerce Departments and five state governments, some of it not clearly attributable to OpenAI. Altman called July's Hugging Face breach "still the most severe event we've seen."

The Blue Cross Blue Shield Association says hospitals' use of AI to document and code patient stays raised the share of inpatient cases billed as medically complex from 37 percent in early 2023 to 40 percent by the end of 2025, with no sign of a change in the care delivered. It puts the extra cost to its member plans at $942 million over two years. AI tools scan records and notes, and ambient scribes listen in the exam room, surfacing diagnoses that can move a stay into a higher payment tier. The figure comes from the insurers' side of a long billing fight, and Abridge founder Shiv Rao warned of a future of "bots fighting bots."

Security firm UpGuard scanned about 300,000 websites using the database platform Supabase and found 16,326 whose tables anyone could read. More than half held personal data such as names, addresses and phone numbers, and some held passwords or login tokens; one valet service exposed more than 100,000 customers along with license plates and visit histories. UpGuard traces much of it to AI coding agents: Supabase now turns on row-level security by default for tables made in its dashboard, but not for tables created through its API, which is how the agents build them.

London-based AI cloud company Nscale raised $3.36 billion in notes led by hedge fund Third Point, which turn into shares once its IPO completes. Roughly $2.4 billion arrives at closing, and NVIDIA is committing $1 billion more in mid-November. The raise matters beyond its size: Nscale's IPO filing said its $44.6 billion agreement with Anthropic, more than 40 percent of its contracted backlog, depends on Nscale raising financing, though neither company has said this round meets that condition. Reports put the listing at about $3 billion raised at a $35 billion valuation.

Meta Muse, the personal AI agent Meta launched on September 8, reached about 3.4 million downloads by Thursday, according to Sensor Tower, and has held the number one spot on the US App Store since September 18. In its first ten days, downloads grew an average of 55 percent a day, against 24 percent for ChatGPT at the same stage. Estimates vary by firm, from about 2.3 million at Appfigures to 4.3 million at Apptopia, and the app is only available in the US and Canada. Sensor Tower says daily users rose 27 percent the day after Meta Connect ended.

AI data center builder Crusoe has pulled out of a deal to buy 29 of Boom Supersonic's 42-megawatt Superpower turbines, gas-fired power plants derived from the engine Boom is developing for its supersonic jet, with deliveries due in 2027. Boom CEO Blake Scholl said turbines are no longer in Crusoe's near-term power mix at Abilene, a line he later deleted; Crusoe says it still plans to use turbines, "just not Boom's." Boom has lost its launch customer, but says it will ship about 250 megawatts to other sites next year and is targeting one gigawatt in 2028.