{ "date": "2026-09-15", "volume": 1, "number": 7, "dateline": "Tuesday, 15 September 2026", "masthead": "The Early Edition", "editionNote": "13 printed", "motto": "What changed, what it costs you, and where to check it.", "premise": { "text": "DeepSeek changed its mind about a model name, and told nobody in a way a date would catch. Below it, the two labs whose changelogs normally set the week have no entry after 10 September, and the work that did ship came from three projects putting bounds on what an agent may read and reach. A print server breached through two three-day-old bugs shows what those bounds are for, and a benchmark turns out to have been scoring the shape of a sentence." }, "front": [ { "block": "lead", "story": "v4-pro-reprieve", "rail": [ "labs-quiet", "copilot-auto-tiers" ] }, { "block": "premise" }, { "block": "index", "name": "Inside this edition" }, { "block": "package", "name": "Bounding what the agent reaches", "rationale": "Three projects, in four days, drew the same kind of line: input the agent consumes and hosts it can reach stop being unlimited by default. None of the three cites the others.", "stories": [ "mcp-go-bounds", "cc-allowed-domains", "gemini-cli-buildfile" ] }, { "block": "boxed", "story": "papercut-swarm" }, { "block": "feature", "story": "truthfulqa-surface" }, { "block": "briefs", "name": "Dates, numbers and one chip", "stories": [ "gpt54-cyber-sunset", "azure-nv-retire", "sas-sparse", "moe-repeat", "cc-org-policy", "fujitsu-monaka" ] }, { "block": "ahead", "items": [ { "when": "Wed 16 Sep, 16:00 ET", "what": "Closed Senate briefing on AI risk, convened by Senator Sanders", "why": "Hinton, Tegmark and Cotra are named as speakers, and no frontier lab is. Sanders's own advisory page refused this paper's fetch, so the detail is secondary.", "status": "reported" }, { "when": "Tue 22 Sep", "what": "Replies due, sanctions motion against DeviantArt in Andersen v. Stability AI", "why": "Carried forward from docket entry 730. This paper could not read the docket today: CourtListener returned 403 on every route, so whether the 15 September responses were filed is unknown.", "status": "confirmed" }, { "when": "Thu 24 Sep", "what": "OpenAI removes sora-2, sora-2-pro and the Videos API", "why": "Carried forward. The replacement column on OpenAI's deprecations page is still empty, and the page was re-read today.", "status": "confirmed" }, { "when": "Thu 24 Sep", "what": "Xi Jinping at the White House", "why": "Carried forward. The fixed point in US-China AI diplomacy this month.", "status": "reported" }, { "when": "Mon 28 Sep", "what": "OpenAI shuts down gpt-3.5-turbo-instruct, babbage-002, davinci-002 and gpt-3.5-turbo-1106", "why": "Carried forward. The replacement named on the deprecations page is gpt-5.6-terra.", "status": "confirmed" }, { "when": "Tue 29 Sep", "what": "Claude Sonnet 4.5 API retirement, no earlier than", "why": "Carried forward. Anything pinned to claude-sonnet-4-5-20250929 needs to move.", "status": "confirmed" }, { "when": "Wed 30 Sep", "what": "Azure retires the NVv3 and NVv4 GPU virtual machines", "why": "New. Fourteen sizes go, UAE North excepted until 31 January 2027. Register the VMTempDiskResizePreview flag before resizing an NVv4.", "status": "confirmed" }, { "when": "Thu 1 Oct", "what": "OpenAI removes gpt-5.4-cyber", "why": "New, announced 11 September. Replacement gpt-5.6-cyber.", "status": "confirmed" }, { "when": "Wed 7 Oct", "what": "Sanctions hearing, Andersen v. Stability AI, before Judge Orrick", "why": "Carried forward. 14:00 in San Francisco, Courtroom 02.", "status": "confirmed" }, { "when": "Sat 10 Oct", "what": "Solar Pro 4 reaches standard pricing", "why": "Carried forward from Upstage's own rate card. This paper has still not read the figures directly: the page renders its prices in JavaScript.", "status": "reported" }, { "when": "Next minor release", "what": "MCP Go SDK removes both MCPGODEBUG compatibility flags", "why": "v1.8.0 schedules plaintextstatefulrejection and blockingcancelnotify for removal in v1.9.0, with no date attached.", "status": "confirmed" }, { "when": "Tue 1 Dec", "what": "OpenAI removes the older GPT Image models from the API", "why": "Carried forward. Replacement gpt-image-2.", "status": "confirmed" }, { "when": "Thu 1 Jul 2027", "what": "California SB 1119's pre-release risk assessments and child defaults bind", "why": "Carried forward. Signed 10 September.", "status": "confirmed" } ] }, { "block": "corrections", "items": [ { "date": "2026-09-11", "text": "This paper's calendar gave \"Mon 14 Sep, 04:00 UTC: DeepSeek routes deepseek-v4-pro to V4.1 Flash\" the status confirmed, and the lead of that edition said neither DeepSeek's pricing page nor its change log offered a way to keep the old model. The reroute did not happen. DeepSeek reversed it, and V4 Pro is still served at the prices that edition printed as about to disappear. The reporting was accurate about what the pages said on 11 September. The error was in the status: a vendor's announced intention about a future date is not a confirmed event, and this paper marked one as though a date on a pricing page made it one. Confirmed now means an official page states that something has happened, or the paper has read the thing itself. A stated future intention is reported, whoever states it." } ] }, { "block": "ledger", "ledger": { "counts": { "swept": 100, "candidates": 24, "deduped": 24, "verified": 17, "printed": 13 }, "note": "The collector's wire carried 100 items generated at 23:30 UTC on 14 September. Ninety-three of them were llama.cpp build tags and arXiv listing rows, which is the highest proportion of machine traffic the wire has yet delivered and the reason nothing in today's paper was found there. Nine reporting areas were then swept live against 11 to 15 September with every previously printed URL excluded. The editor refetched the lead entirely: DeepSeek's pricing page and change log were read directly, not through a reporter, and the footnote quoted in the lead was copied from the page today. That mattered, because the follow-up desk reported the reversal on the strength of matching Internet Archive digests, which would only have shown that a page had not changed, and an unchanged page is not evidence of a reversal. The reversal is real, and the evidence for it is the current text of the footnote rather than the absence of a diff. The Internet Archive was answering \"temporarily offline\" throughout, so no snapshot comparison was available to anyone today. Four other reporter claims were corrected before print. A secondary account of the PaperCut campaign was traced to GreyNoise's own post, which turns out to predate this window by two days and to assert that OpenAI Codex and a DeepSeek model powered the attack without publishing any artefact naming either; that line is attributed to GreyNoise and not adopted. Both PaperCut CVE records were then read at the NVD, which resolved a disagreement two trackers had about the scores by carrying both scales, and the chain between the two bugs described in the box is the editor's reading of those records rather than anyone's published analysis. An infrastructure item built on a Broadcom earnings call was spiked when the 8-K filed alongside it proved to contain none of the figures attributed to it. A Broadcom chief executive's remark rejecting a rival's forecast was spiked for carrying no number and no commitment. A model index discrepancy worth 17 points was dropped because the editor could not re-read it in time, not because it is wrong. On the machinery: the reporting workflow was refused a fifth consecutive time. The session held a valid workflow-authoring receipt on this attempt, so the first of the two failure modes seen last week did not recur; the guard printed its preflight card, which under this permission mode is shown to nobody, and refused. Whether this paper's saved workflow should be exempt from that guard remains a decision for its owner and has still not been made. The beats ran as parallel agents instead, and six of the twelve returned a delivery receipt to the editor rather than their report, which cost a round trip each to recover; two of those six had already written the story and only failed to hand it over. On the gates: rule 14 blocked on the first pass and every one of those sentences was rewritten rather than the detector widened. The Board beat returned nothing at all. No filing, ruling, rule or enforcement action anywhere this paper checked carries a date between 11 and 15 September, and the sources checked are named below. Every substantial story then went to a blind judge that saw the body text and the ten-criterion rubric and nothing else, before printing rather than after. The lead scored 19 of 20 and the boxed story 20. Two stories in the package failed a criterion outright, both the same one: neither named a concession and ruled on it, and one of them carried no verdict of the paper's at all, having described a vendor's changelog in the vendor's own frame. Both were rewritten, and the concessions used are true ones rather than the invented example a judge offered: that the MCP nesting limit alone takes no configured value, and that Claude Code's per-command network grant applies only in auto mode with sandboxing, so it does nothing for anyone running with permissions bypassed. The judge also caught the lead's price comparison resting on figures four days old, which sent the editor to OpenRouter's models API for today's rates; they are in the lead and they support the claim the stale ones were carrying. One sentence in the lead said DeepSeek had twice proposed to move this name. It had proposed it once, and the sentence now says once. Four rule 14.2 warnings stand unfixed and are a disagreement rather than an oversight: the detector reads \"the first step\", which is GitHub's phrase inside quotation marks, and \"which the first hands it\", where first is an ordinal noun naming a CVE, as ranking claims owing a displaced rival. Neither is one. This edition was read back after publishing and republished within the hour. The reader caught what the gates and the judges had not: a brief that made 11 September to 1 October nineteen days when it is twenty, the same pair of benchmark figures printed three times in one story, and a sentence dating a change to \"Thursday\" for no reason a reader could check.", "omitted": [ "Everything on the frontier-lab beat, because there was nothing. OpenAI's and Anthropic's own developer changelogs both stop on 10 September, which is printed beside the lead rather than buried here.", "The Board beat entirely. The EU's AI Act timeline, the Federal Register, the Colorado Attorney General's rulemaking docket, the FTC's enforcement page and two China trackers were each read, and the most recent dated entry on any of them is 11 August. California's bill signings were 9 and 10 September, before this window.", "Andersen v. Stability AI. Responses to the sanctions motion were due yesterday and this paper cannot tell you whether they were filed, because CourtListener returned 403 to every route attempted, including the RECAP archive.", "Anthropic's threat-intelligence report naming Moonshot AI, Alibaba and DeepSeek. Dated 10 September, one day outside this window, and the desk sent to reach Anthropic's own copy of it returned without one. It is the strongest thing this paper has not printed.", "The Ling-3.0-flash-VL card claiming 42 on the Artificial Analysis Intelligence Index where that index's own listing shows 25. The two figures come from different methodology versions, which is a real story, but the weights were published on 4 September and the editor could not re-read either number today.", "An Open WebUI authentication bypass through wildcard characters in an OAuth subject claim, CVE-2026-87016, fixed in 0.11.1. A clean mechanism and a high score, published at 21:23 UTC on 10 September, ninety-seven minutes outside this window.", "Relay's shutdown, which took paid customers offline on 14 September. The only sources are secondary and the announcement was made on 17 August.", "Broadcom's Anthropic capacity commitments, spiked twice: the figures live in an earnings call of 2 September and not in the 8-K filed with it.", "Tier IV's chief executive saying the company will build its own autonomous-driving silicon to break Nvidia's position. An intention with no date, no part and no number, in a paywalled interview.", "Three European Commission GenAI pilots for public administration, which held a kick-off meeting on 14 September. Grants that started on 1 July holding a meeting is not a change a builder acts on.", "Four arXiv papers this paper's research reporter never opened, on type diversity, voice agents, domain-specific hallucination detection and attention disaggregation. They were not checked and found empty; they were not checked." ] } }, { "block": "wire", "snapshot": [ { "title": "SAS: Simple Attention Sparsification via End-to-End Optimization of Context Ranking", "href": "https://arxiv.org/abs/2609.13141v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Investigating Temporal Motion Features for Pose-to-Text Indian Sign Language Translation", "href": "https://arxiv.org/abs/2609.12993v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Type Diversity Enables Transformers to Generalise Compositionally", "href": "https://arxiv.org/abs/2609.13144v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "MAxBench: A Multinomial Concept Recovery Benchmark", "href": "https://arxiv.org/abs/2609.13072v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Tasks over Application Manuals: Revealing Gaps in Long-Horizon Procedural Reasoning for Language Models", "href": "https://arxiv.org/abs/2609.13005v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Kraken: LLM-based Speech-to-Speech Translation via Low-bitrate VQ and Dual-path Source Conditioning", "href": "https://arxiv.org/abs/2609.13045v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Expert-Space Exploration in MoE Reinforcement Learning", "href": "https://arxiv.org/abs/2609.13058v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Judging by the Cover: Cleaning LLM Truthfulness Benchmarks to Avoid Surface-Level Feature Leakage", "href": "https://arxiv.org/abs/2609.13003v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "MP-Bench: Evaluating Voice Agents as a Multiparty Conversation Participant", "href": "https://arxiv.org/abs/2609.13076v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Continue, Adapt, or Yield: In-Turn Adaptation to Overlapping Speech in Full-Duplex Agents", "href": "https://arxiv.org/abs/2609.13117v1", "source": "arXiv cs.CL", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "Diffusion Models and Concept Formation", "href": "https://arxiv.org/abs/2609.13047v1", "source": "arXiv cs.LG", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" }, { "title": "MAxBench: A Multinomial Concept Recovery Benchmark", "href": "https://arxiv.org/abs/2609.13072v1", "source": "arXiv cs.LG", "at": "2026-09-14T05:00:49.520Z", "time": "05:00" } ] } ], "stories": [ { "id": "v4-pro-reprieve", "section": "Models", "kicker": "The reroute that wasn't", "treatment": "lead", "headline": "DeepSeek has called off the reroute, and V4 Pro answers its own name after all", "standfirst": "A sentence added to a change-log entry dated 10 September says the model continues \"in response to user demand\". Its rate card did not move, and this paper printed the cancellation as a certainty in its calendar.", "byline": "By the Newsroom", "credit": "From DeepSeek's pricing page and change log, both read 15 September", "figure": { "type": "table", "caption": "The deepseek-v4-pro endpoint, as this paper described it on 11 September and as DeepSeek's page describes it today. Rates are off-peak; peak rates are double, 01:00 to 04:00 and 06:00 to 10:00 UTC on weekdays.", "columns": [ "deepseek-v4-pro", "Printed 11 September", "Read 15 September" ], "rows": [ [ "Model that answers", "V4.1 Flash, from Monday", "DeepSeek-V4-Pro-0813" ], [ "Input per M, cache miss", "$0.15", "$0.66" ], [ "Output per M", "$0.60", "$1.98" ], [ "Concurrency limit", "2,500", "500" ] ] }, "body": [ { "type": "p", "text": "DeepSeek is still serving DeepSeek-V4-Pro-0813 to callers of deepseek-v4-pro, four days after the date it gave for switching them to a cheaper model." }, { "type": "p", "text": "A vendor's stated plan for its own model names is not a fact about next week. This paper printed one as though it were, and the correction below says so." }, { "type": "p", "text": "The reversal is one sentence, and DeepSeek put it in two places. The pricing page carries it as footnote two: \"In response to user demand, we have decided to continue providing API services for DeepSeek V4 Pro after September 14, 2026, with the billing method remaining unchanged.\" The same sentence sits in the change log." }, { "type": "p", "text": "The rate card agrees with it. The model table gives deepseek-v4-pro a model version of DeepSeek-V4-Pro-0813, at $0.66 per million input tokens off-peak on a cache miss against $1.98 per million output. Those are the figures this paper printed on 11 September as the prices about to disappear, unchanged. Its concurrency limit stands at 500, a fifth of the Flash tier's 2,500, and that ceiling is what DeepSeek did not lift." }, { "type": "figure", "figure": { "type": "timeline", "caption": "What DeepSeek published about one model name in five days.", "events": [ { "when": "10 Sep", "what": "Change log announces V4.1 Flash and reroutes two retired Flash names to it" }, { "when": "11 Sep", "what": "Pricing page footnote states V4 Pro will route to V4.1 Flash from 14 September" }, { "when": "by 15 Sep", "what": "Same footnote replaced: V4 Pro continues, billing unchanged", "accent": true } ] } }, { "type": "p", "text": "Here is the part that costs a reader something. DeepSeek did not post the reversal as a new entry. It edited the entry headed 10 September, so anyone who checked the change log by looking for a date later than the one they had already read would have found nothing, and concluded the switch was still coming." }, { "type": "p", "text": "The resale market has not caught up, and the gap is the reader's to collect. On OpenRouter's rate card this morning the dated slug deepseek-v4-pro-0813 bills $0.983 per million input tokens, half as much again as DeepSeek's own off-peak $0.66, and its undated deepseek-v4-pro slug bills $1.60." }, { "type": "p", "text": "The policy itself did not reverse. DeepSeek retired V4 Flash and V4 Flash Vision Exp on 10 September, and the change log says the names deepseek-v4-flash and deepseek-v4-flash-vision-exp are \"temporarily routed\" to V4.1 Flash. Those two names still buy a price tier rather than a set of weights. Only the expensive one was pulled back." }, { "type": "p", "text": "Against that, the reprieve is worth less than it reads. DeepSeek's sentence promises \"further notice should there be any changes\" and names no notice period, and the page below it reserves the right to adjust prices. A decision reversed in four days can be reversed again in four." }, { "type": "p", "text": "The retired Flash names are the tell. DeepSeek will reroute a name when nobody is paying much to keep it, which is why the cheap names went and the expensive one stayed." } ], "consequence": "If you moved off deepseek-v4-pro last week, move back. DeepSeek's own off-peak rate of $0.66 per million input tokens undercuts every OpenRouter route to the same checkpoint, the cheapest of which bills $0.983. If you set a provider order on OpenRouter's 0813 slug to exclude DeepSeek, that ordering is now routing you around the cheapest seller. Pin the dated slug wherever a host offers one, because the undated name is the one DeepSeek has already once proposed to move.", "confidence": "verified", "note": "The reversal sentence is DeepSeek's, and no reason beyond \"user demand\" is given. DeepSeek publishes no notice period. OpenRouter's rates were read from its models API on 15 September and change without notice. The 11 September figures are as this paper printed them from the same pages four days ago; the Internet Archive was answering \"temporarily offline\" while this edition was reported, so the prior page state could not be re-read from a snapshot today.", "sources": [ { "label": "DeepSeek Models & Pricing", "url": "https://api-docs.deepseek.com/quick_start/pricing", "publisher": "DeepSeek", "date": "2026-09-15", "kind": "primary", "provenance": { "byline": "Not published on the page", "institution": "DeepSeek, which sets both the rate and the routing", "stake": "The paper's best guess: V4 Pro's 500-request concurrency ceiling against Flash's 2,500 suggests the older model is expensive to serve, so keeping it is a concession to paying customers rather than a change of plan." } }, { "label": "DeepSeek API change log", "url": "https://api-docs.deepseek.com/updates", "publisher": "DeepSeek", "date": "2026-09-10", "kind": "primary", "provenance": { "byline": "Not published on the page", "institution": "DeepSeek", "stake": "The paper's best guess: amending a dated entry rather than adding one keeps a reversal off the top of the page, and the change log is the surface most integrators poll." } }, { "label": "OpenRouter models API", "url": "https://openrouter.ai/api/v1/models", "publisher": "OpenRouter", "date": "2026-09-15", "kind": "primary" } ] }, { "id": "labs-quiet", "section": "Models", "kicker": "Nothing filed", "treatment": "rail", "headline": "Neither OpenAI's nor Anthropic's developer changelog has an entry after 10 September", "standfirst": "Two pages that normally carry the week are empty for it.", "byline": "By the Newsroom", "credit": "Both changelogs read 15 September", "body": [ { "type": "p", "text": "OpenAI's API changelog and Anthropic's API release notes both end on 10 September, read on the fifth day after it." }, { "type": "p", "text": "That is not a gap in this paper's reporting. Nine areas were swept live against 11 to 15 September and returned no frontier-lab item at all, and the two pages where such an item would have to appear confirm why." }, { "type": "p", "text": "There is nothing here to act on, which is the point of printing it. A week with no lab release is a week to spend on the things below, and those all have deadlines." }, { "type": "p", "text": "The last entries on both pages, on 10 September, are the ones this paper printed on 11 September: the Agents API and key expiry from OpenAI, the Managed Agents permission policy from Anthropic." } ], "consequence": "Nothing to do. If you are holding a migration for a model announcement, the announcement did not come this week.", "confidence": "verified", "sources": [ { "label": "OpenAI API changelog", "url": "https://developers.openai.com/api/docs/changelog", "publisher": "OpenAI", "date": "2026-09-10", "kind": "primary" }, { "label": "Anthropic API release notes", "url": "https://platform.claude.com/docs/en/release-notes/api", "publisher": "Anthropic", "date": "2026-09-10", "kind": "primary" } ] }, { "id": "copilot-auto-tiers", "section": "Tooling", "kicker": "Three dials, one bill", "treatment": "rail", "headline": "GitHub gave Copilot's model picker three settings, and the bill ignores which one you pick", "standfirst": "Efficiency, balance and intelligence draw on the same set of models, and charging follows whichever model answers.", "byline": "By the Newsroom", "credit": "From GitHub's changelog entry of 14 September", "body": [ { "type": "p", "text": "GitHub added three tiers to Copilot's automatic model selection on 14 September, named efficiency, balance and intelligence." }, { "type": "p", "text": "The tier is a preference, not a route. GitHub's entry says \"all three tiers use the same set of available models\" and that auto \"individually evaluates each prompt\", offering its own example: a docstring may still be written by a small model under the intelligence setting." }, { "type": "p", "text": "So the setting cannot be used as a cost control either way. GitHub is explicit: \"Usage is charged based on the model auto selects, regardless of tier.\" Paid subscribers keep a tenth off usage billed through auto." }, { "type": "p", "text": "What the entry never says is which tier answers for the people who never open the setting, and GitHub calls the feature \"the first step\"." } ], "consequence": "Do not use the tier as a budget control; it changes a preference and not the price. If you track Copilot spend per seat, keep tracking the model names in the usage export rather than the tier.", "confidence": "verified", "sources": [ { "label": "Configure cost and quality in Copilot auto model selection", "url": "https://github.blog/changelog/2026-09-14-configure-cost-and-quality-in-copilot-auto-model-selection/", "publisher": "GitHub", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Not published on the page", "institution": "GitHub, which bills for the usage the picker generates", "stake": "The paper's best guess: a visible tier answers the complaint that auto is opaque without giving up the routing decision, which is where the margin sits." } } ] }, { "id": "mcp-go-bounds", "section": "Tooling", "kicker": "Every buffer, capped", "treatment": "standard", "headline": "The MCP Go SDK now rejects JSON at 1,000 levels of nesting, before the parser recurses", "standfirst": "Version 1.8.0 bounds every decoding path that buffers input, and the two flags that undo it expire at 1.9.0.", "byline": "By the Newsroom", "credit": "From the v1.8.0 release notes, published 14 September", "figure": { "type": "table", "caption": "What each transport in MCP Go SDK v1.8.0 now refuses to buffer without a limit.", "columns": [ "Path", "The bound it gained" ], "rows": [ [ "JSON decoding, all transports", "rejected past 1,000 levels of nesting" ], [ "SSE client and streamable client", "MaxEventSize, bytes per single event" ], [ "stdio transport", "StdioTransport.MaxLineLength, per JSON-RPC frame" ], [ "OAuth dynamic client registration", "response read bounded to 1 MB" ] ] }, "body": [ { "type": "p", "text": "The MCP Go SDK shipped v1.8.0 on 14 September, and its release notes state that \"every decoding path that buffers incoming input is now bounded\"." }, { "type": "p", "text": "The mechanism is ordering, not size. A nesting limit that fires after the parser has begun recursing does not help, so the check runs first: payloads are \"rejected past 1000 levels of nesting, before the parser recurses\". Alongside it, both SSE readers cap bytes per event through MaxEventSize, the stdio transport caps a frame through StdioTransport.MaxLineLength, and an OAuth dynamic client registration response is read only to 1 MB." }, { "type": "p", "text": "Two of those three bounds are fields a server can raise. The nesting depth is not: the notes name MaxEventSize and StdioTransport.MaxLineLength as settings that take a value, against a flat 1,000 levels with no knob at all. That is the right call, because a tool argument legitimately nested a thousand deep is not a thing anyone has, and a limit nobody can raise is a limit an attacker cannot talk a careless operator into raising either." }, { "type": "p", "text": "Two behaviour changes come with an expiry date attached. Setting MCPGODEBUG to plaintextstatefulrejection=1 restores plain-text HTTP 400 responses in place of JSON-RPC errors, and blockingcancelnotify=1 restores synchronous cancellation delivery. The release schedules both for removal in v1.9.0, so a server leaning on either has one minor version to rewrite its error handling." }, { "type": "p", "text": "None of this is a protocol change. The notes say the release \"adds no new protocol revision\" and that 2026-07-28 remains the newest version the SDK negotiates, which makes this the transport learning to distrust its own input rather than the specification learning anything." } ], "consequence": "Upgrade, then check whether your clients parse plain-text 400s: that behaviour now needs an MCPGODEBUG flag and the flag dies at v1.9.0. If you generate deeply nested tool arguments, measure the depth before you upgrade rather than after.", "confidence": "verified", "sources": [ { "label": "modelcontextprotocol/go-sdk v1.8.0", "url": "https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0", "publisher": "Model Context Protocol", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Release notes credit the hardening pull requests to yarolegovich and the version-restriction work to guglielmo-san", "institution": "The Model Context Protocol project", "stake": "The paper's best guess: the notes say these were found by \"users running the new protocol at scale\", so the bounds are a response to reported failures rather than an audit." } } ] }, { "id": "cc-allowed-domains", "section": "Tooling", "kicker": "Per command, per host", "treatment": "standard", "headline": "Claude Code will now open a network host for one command and refuse it to the next", "standfirst": "Version 2.1.271 adds allowed_domains to Bash, PowerShell and Monitor in sandboxed auto mode.", "byline": "By the Newsroom", "credit": "From the Claude Code changelog, version 2.1.271, 14 September", "body": [ { "type": "p", "text": "Anthropic added a per-command allowed_domains setting to Claude Code on 14 September, covering Bash, PowerShell and Monitor in auto mode with sandboxing." }, { "type": "p", "text": "The unit of the grant is the command, not the session. The changelog puts it plainly: \"the hosts a command needs are reviewed with it and opened for it alone; other hosts are refused.\" An approval to fetch from one domain therefore expires with the command that asked for it, instead of widening what everything after it can reach." }, { "type": "p", "text": "The same release adds omitClaudeMd to agent frontmatter, letting custom and plugin subagents start without user, project and local CLAUDE.md files while managed policy files still load, which separates instructions a repository can write from instructions an administrator can." }, { "type": "p", "text": "Three of the release's Bash permission fixes describe checks that could be walked past: by a wildcard expanding to files the checker never saw, by an option the checker did not recognise, and by shell variable declaration flags misrepresenting the command being run." }, { "type": "p", "text": "The limit is in Anthropic's own first line. This applies \"in auto mode with sandboxing\", so anyone running with permissions bypassed gets none of it, which is most people running an agent unattended overnight. A network default that protects the cautious configuration and not the reckless one is worth having and is not worth relying on." } ], "consequence": "If you run Claude Code in auto mode with sandboxing, the network is now deny-by-default per command and a command that quietly relied on a host opened earlier will start failing: list the hosts each command needs before upgrading a CI runner to 2.1.271. If you run with permissions bypassed, this changes nothing for you, which is the reason to stop doing that.", "confidence": "verified", "sources": [ { "label": "Claude Code CHANGELOG, 2.1.271", "url": "https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md", "publisher": "Anthropic", "date": "2026-09-14", "kind": "primary", "provenance": { "byline": "Not published on the page", "institution": "Anthropic", "stake": "The paper's best guess: three of the release's permission fixes describe ways a check could be bypassed, so the per-command grant narrows what a bypass would be worth." } } ] }, { "id": "gemini-cli-buildfile", "section": "Tooling", "kicker": "Nightly only", "treatment": "standard", "headline": "A Gemini CLI nightly closes a path from a repository's build file to the agent's own flags", "standfirst": "The fix has not reached a stable release; the newest one is still 0.59.0 from 8 September.", "byline": "By the Newsroom", "credit": "From the v0.61.0 nightly release page of 12 September and the repository's latest stable release", "body": [ { "type": "p", "text": "Google merged a fix titled \"prevent indirect prompt injection via build file modifications and untrusted flags\" into a Gemini CLI nightly published on 12 September." }, { "type": "p", "text": "Google's own merge description names the vector, and it is one a reviewer skims. A build file is not prose the agent reads, it is configuration the agent obeys, so text placed in it by whoever last touched the repository could reach the agent as flags rather than as content. A second merge in the same nightly hardens the sandbox's filesystem boundaries and isolates runtime state." }, { "type": "p", "text": "You cannot install this from a stable release. The newest stable tag is 0.59.0, published on 8 September, and the 0.61.0 line exists only as prereleases whose notes run to two fix lines and nothing else." }, { "type": "p", "text": "Neither merge carries a CVE or an advisory, so there is no affected-version range to read and no way to tell whether the stable line is exposed." } ], "consequence": "If you point Gemini CLI at repositories you do not control, treat build files as untrusted input today rather than waiting for the fix to reach stable. There is no advisory, so you cannot check whether 0.59.0 is affected.", "confidence": "verified", "note": "The two merges are described only by their pull-request titles on the release page. No advisory, CVE or affected-version range has been published for either, so the exposure of the stable line is unknown.", "sources": [ { "label": "gemini-cli v0.61.0-nightly.20260912", "url": "https://github.com/google-gemini/gemini-cli/releases/tag/v0.61.0-nightly.20260912.g9c1b0a610", "publisher": "Google", "date": "2026-09-12", "kind": "primary" }, { "label": "gemini-cli latest stable release", "url": "https://github.com/google-gemini/gemini-cli/releases/latest", "publisher": "Google", "date": "2026-09-08", "kind": "primary" } ] }, { "id": "papercut-swarm", "section": "Infrastructure", "kicker": "Nearly cut", "treatment": "boxed", "headline": "Two PaperCut bugs, three days old, reached 395 organisations", "standfirst": "Kept although it predates this window, because it is the attack the three fixes above are defending against, and this paper has never printed it.", "byline": "By the Newsroom", "credit": "From the NVD records for both CVEs, read 15 September, and GreyNoise's account of 9 September", "body": [ { "type": "p", "text": "GreyNoise counted 440 compromised PaperCut NG and MF servers across 395 organisations, more than one apiece, in 48 countries." }, { "type": "p", "text": "The campaign it describes ran from the last day of August. Neither bug is remote code execution on its own, and that is the mechanism. CVE-2026-81578 lets an unauthenticated request to the web management interface \"trigger backend actions prior to the completion of access validation checks\", which is enough to write a configuration value. CVE-2026-82078 then reads one of those values, the database driver class name, and instantiates it \"without validating against an allowlist of approved drivers\". The second needs high privileges, which the first hands it." }, { "type": "p", "text": "CVSS 3.1 calls the unauthenticated bug the worse of the two, at 9.8 against 9.1. CVSS 4.0 inverts that, 8.8 against 9.4, because the newer scale weights what a compromise reaches next rather than what it took to start." }, { "type": "p", "text": "Both records were published on 28 August, three days before the campaign GreyNoise dates. PaperCut's fixed builds are 24.1.10, 25.0.13 and 26.0.5." }, { "type": "p", "text": "GreyNoise attributes the operation to AI agents, and its published evidence for that is behavioural: the campaign hit countries its operator appeared to have tried to exclude. It also names OpenAI Codex and a DeepSeek model as the tooling without disclosing an artefact that identifies either, and this paper does not adopt that line." } ], "consequence": "Upgrade to 24.1.10, 25.0.13 or 26.0.5; the fix is a version, not a setting. Then look through your own estate for the shape rather than the product: a bug that only writes configuration is a privilege escalation whenever some other component reads that configuration as a class name, a path or a URL.", "confidence": "reported", "note": "The CVE descriptions, scores and publication dates were read at the NVD. The chaining of the two bugs is this paper's reading of those two records; GreyNoise publishes no request sequence. The campaign counts are GreyNoise's own and have not been independently confirmed. PaperCut's own bulletin would not render on fetch, so the fixed version strings come from trackers quoting it rather than from PaperCut's page.", "sources": [ { "label": "NVD record, CVE-2026-81578", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81578", "publisher": "National Vulnerability Database", "date": "2026-08-28", "kind": "primary" }, { "label": "NVD record, CVE-2026-82078", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82078", "publisher": "National Vulnerability Database", "date": "2026-08-28", "kind": "primary" }, { "label": "Agents Gone Wild: an AI-orchestrated global campaign against PaperCut NG/MF", "url": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf", "publisher": "GreyNoise", "date": "2026-09-09", "kind": "secondary", "provenance": { "byline": "Published under the company name, with no individual author on the page", "institution": "GreyNoise, which sells internet-scan telemetry", "stake": "The paper's best guess: a campaign characterised as autonomous agents is a stronger argument for scan telemetry than the same campaign characterised as ordinary mass scanning, and GreyNoise publishes no artefact naming the models it blames." } } ] }, { "id": "truthfulqa-surface", "section": "Science", "kicker": "Marking the shape", "treatment": "feature", "headline": "A six-feature classifier beats the TruthfulQA leaderboard without reading the question", "standfirst": "Counting negations, hedges and word lengths in the answer alone beats every model on the public leaderboard. The authors then delete the 314 question pairs that made it possible.", "byline": "By the Newsroom", "credit": "From arXiv 2609.13003, submitted 11 September", "figure": { "type": "bars", "caption": "Accuracy at picking TruthfulQA's correct answer. The classifier sees only the answer text, never the question.", "series": [ { "label": "Surface6 classifier, answer text only", "value": 68.9, "accent": true }, { "label": "Best model, public leaderboard", "value": 66.9 }, { "label": "Same classifier, after cleaning", "value": 52.2 }, { "label": "Chance", "value": 50 } ] }, "body": [ { "type": "p", "text": "Researchers at Utah, UMass Amherst, Thoughtworks and Martian AI scored 68.9 on TruthfulQA with a six-feature logistic classifier. That is ahead of the best model on the public leaderboard, at 66.9." }, { "type": "p", "text": "The classifier never sees the question. That is the finding: a benchmark meant to measure truthfulness can be partly solved by measuring the shape of a sentence." }, { "type": "p", "text": "What the classifier does is add up six counts and compare the total. Number of negations, whether a negation opens the answer, hedge rate, word count, average token length and type-token ratio each get a learned weight, and the weighted sum decides which of two candidate answers is the true one. The question is never read. The authors state the comparison themselves, writing that \"this accuracy (68.9%) is higher than the best model score on the llm-stats TruthfulQA leaderboard (66.9%, by Granite 3.3 8B Instruct, as of May 2026)\"." }, { "type": "p", "text": "Negation carries most of it. Dropping the negation features alone costs the classifier 0.064 of its accuracy, the largest single contribution of the six, which says the incorrect options in TruthfulQA are written differently from the correct ones rather than merely being wrong." }, { "type": "p", "text": "Their repair is to delete the leaky pairs. TruthfulQA-476 keeps 476 of the original 790 pairs. On it the same classifier drops to 52.2 per cent, against a chance baseline of 50, which is the number showing the leak was removed rather than merely reduced." }, { "type": "p", "text": "The obvious objection is that everyone's score falls together, so comparisons survive. It holds, and the authors measure it: model rankings on the full and cleaned sets correlate at a Spearman rho of 0.915, where 1.0 would be an order unchanged by the cleaning. Nobody picked the wrong model because of this. What was wrong was every absolute figure, including the ones in vendor cards." }, { "type": "p", "text": "They audited fourteen benchmarks the same way, and TruthfulQA is not the worst of them. HaluEval QA separates at an AUC of 0.973 on surface features alone, against 0.715 for TruthfulQA." }, { "type": "p", "text": "The authors concede their probe is \"intentionally narrow and simple\", six hand-picked statistics where embeddings would find more, and rule that the right response is to treat the audit as a floor on leakage rather than a measurement of it." }, { "type": "p", "text": "Their pruning method is greedy rather than optimal, because AUC cannot be decomposed per example, so TruthfulQA-476 is one defensible cleaned set and not the cleaned set." }, { "type": "p", "text": "So the paper's ruling is that a published TruthfulQA figure now means less than it did last week, and nobody yet knows by how much on any given leaderboard, because none has rerun on the cleaned set." } ], "consequence": "Stop quoting an absolute TruthfulQA number in a model card or an eval report; swap to TruthfulQA-476 and say which you used. Comparisons between models you evaluated yourself are safe. If you built an internal benchmark by writing correct and incorrect answers in separate sittings, run these six features over it before you trust its absolute score.", "confidence": "verified", "sources": [ { "label": "Judging by the Cover: Cleaning LLM Truthfulness Benchmarks to Avoid Surface-Level Feature Leakage", "url": "https://arxiv.org/abs/2609.13003", "publisher": "arXiv", "date": "2026-09-11", "kind": "primary", "provenance": { "byline": "Authors at the University of Utah, Thoughtworks, UMass Amherst and Martian AI", "institution": "A mixed academic and commercial group", "stake": "The paper's best guess: Martian AI sells model routing, which is priced on knowing which model to trust for a query, so a result that discredits absolute benchmark scores argues for measuring models yourself." } } ] }, { "id": "gpt54-cyber-sunset", "section": "Models", "kicker": "Three weeks", "treatment": "brief", "headline": "OpenAI gave gpt-5.4-cyber a shutdown date of 1 October", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "OpenAI added a deprecation row dated 11 September: gpt-5.4-cyber leaves the API on 1 October and the named replacement is gpt-5.6-cyber. Unlike the Sora row further down the same page, the replacement column is filled." }, { "type": "p", "text": "Twenty days separate the notice from the shutdown." } ], "consequence": "Grep for gpt-5.4-cyber and move it to gpt-5.6-cyber before 1 October.", "confidence": "verified", "sources": [ { "label": "OpenAI gave gpt-5.4-cyber a shutdown date of 1 October", "url": "https://developers.openai.com/api/docs/deprecations", "publisher": "OpenAI", "date": "2026-09-11", "kind": "primary" } ] }, { "id": "azure-nv-retire", "section": "Infrastructure", "kicker": "Two weeks", "treatment": "brief", "headline": "Azure retires the NVv3 and NVv4 GPU families on 30 September", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Microsoft retires six NVv3 sizes and eight NVv4 sizes on 30 September, pointing customers at NVads-A10 v5 and NVads-v710 v5. UAE North runs to 31 January 2027. Reserved-instance sales for both families ended on 2 November 2025." }, { "type": "p", "text": "Resizing an NVv4 to NVads_V710_v5 fails until the subscription is registered for the VMTempDiskResizePreview feature flag, which Microsoft documents in the retirement notice itself." } ], "consequence": "Migrate before 30 September, and register the feature flag first or the resize errors.", "confidence": "verified", "sources": [ { "label": "Azure retires the NVv3 and NVv4 GPU families on 30 September", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/sizes/lifecycle/retirement/nvv3-series-retirement", "publisher": "Microsoft", "date": "2026-09-15", "kind": "primary" } ] }, { "id": "sas-sparse", "section": "Science", "kicker": "Sparse attention", "treatment": "brief", "headline": "Training the token selector end to end lifts GPQA Diamond by 15.5 points at a 1,024-token budget", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "SAS folds the token selector's score into the attention softmax, so the training loss reaches the ranking decision. A hard top-K cut lets no gradient through to what it threw away. On Qwen3-14B it scores 61.14 on GPQA Diamond against SeerAttention-R's 45.64, with dense attention at 65.25." }, { "type": "p", "text": "The gain does not travel. On long-context and agentic tool-use benchmarks the same method moves scores by under 4 points, against the 15.5 it adds on GPQA Diamond." } ], "consequence": "Worth testing if you serve reasoning workloads under a tight KV budget, and not otherwise.", "confidence": "verified", "sources": [ { "label": "Training the token selector end to end lifts GPQA Diamond by", "url": "https://arxiv.org/abs/2609.13141", "publisher": "arXiv", "date": "2026-09-11", "kind": "primary" } ] }, { "id": "moe-repeat", "section": "Science", "kicker": "Repeated data", "treatment": "brief", "headline": "Mixture-of-experts models start overfitting repeated data at half a dense model's budget", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Stanford and Washington report dense models tolerating 8x data repetition against 4x for matched MoE models. The sparse advantage is gone entirely by 32x. Router assignments go near-stationary early, so each expert memorises one fixed slice of tokens." }, { "type": "p", "text": "Masking-based regularisation pushes the break-even past 64x, though the authors write that \"no method fully matches the performance of all-unique training data\"." } ], "consequence": "Halve the repetition budget you would assume from dense experience before continuing to train an MoE on a fixed corpus.", "confidence": "verified", "sources": [ { "label": "Mixture-of-experts models start overfitting repeated data at", "url": "https://arxiv.org/abs/2609.11917", "publisher": "arXiv", "date": "2026-09-10", "kind": "primary" } ] }, { "id": "cc-org-policy", "section": "Tooling", "kicker": "Stale policy", "treatment": "brief", "headline": "Claude Code was reusing a cached organisation policy after an account switch", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Version 2.1.271 fixes a stale permission set staying in force until the next hourly check, after a user changes credentials mid-session. A second fix covers tool and command lists not updating when a policy loads after startup." }, { "type": "p", "text": "Anyone administering several Anthropic organisations from one machine was governed by whichever they opened first." } ], "consequence": "Upgrade to 2.1.271 if you switch between organisations in a session.", "confidence": "verified", "sources": [ { "label": "Claude Code v2.1.271 release", "url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.271", "publisher": "Anthropic", "date": "2026-09-14", "kind": "primary" } ] }, { "id": "fujitsu-monaka", "section": "Silicon", "kicker": "From Fugaku", "treatment": "brief", "headline": "Fujitsu is selling its MONAKA inference CPU into the US server channel from 2027", "byline": "By the Newsroom", "body": [ { "type": "p", "text": "Nikkei reports that an unnamed major US server maker has already agreed to buy Fujitsu's MONAKA chip." }, { "type": "p", "text": "MONAKA is a processor for inference derived from Fujitsu's Fugaku supercomputer silicon, and selling starts in 2027 rather than this year or next." } ], "consequence": "Nothing to do now; note it if you are writing a multi-year inference procurement that assumes one supplier.", "confidence": "reported", "sources": [ { "label": "Fujitsu is selling its MONAKA inference CPU into the US serv", "url": "https://www.nikkei.com/article/DGXZQOUC089IZ0Y6A900C2000000/", "publisher": "Nikkei", "date": "2026-09-12", "kind": "secondary" } ], "note": "Nikkei's article is paywalled and this paper read only the portion served to an anonymous reader. Nikkei does not name the buyer. No Fujitsu release announcing MONAKA's commercialisation was found, and the cumulative revenue target Nikkei reports is not printed here because the figure could not be read on the page.", "global": true } ] }