💬 Editor’s Note
There hasn’t been an issue since 21 August. I kept postponing it, so this one covers the whole gap from the three Fridays I missed.
A lot happened in three weeks.
📰 Top News
Kimi sent your prompts to Claude
Anthropic says Moonshot routed Kimi user requests to Claude without telling the people who sent them, then showed Claude’s answers as Kimi’s. Bloomberg reported one burst of almost 300,000 requests through 5,380 fraudulent accounts, mostly appearing to be in Singapore and Japan.
Anthropic says DeepSeek and Xiaomi used similar tactics. The Chinese Commerce Ministry rejected the wider US accusations of industrial-scale distillation, while the companies named in this report had not responded when Bloomberg published.
OpenAI’s math claim became a privacy fight
OpenAI announced progress on a forced version of the Navier-Stokes problem, one of the seven Millennium Prize Problems. The proof still needs long peer review, and it does not settle every version of the problem.
NYU mathematician Tristan Buckmaster says OpenAI arrived at the same direction as private work he had developed with Anthropic researcher Levent Alpöge after the pair used Codex during a year of research. OpenAI said no specific user data was accessed for the result, but it could not rule out de-identified product data helping improve its models. Buckmaster also says an OpenAI researcher asked why he would ruin his career when he rejected the publication options offered to him.
The proof still needs review, and the data and credit dispute is unresolved.
Nvidia bought the open model hub
Nvidia reportedly agreed to pay about $13 billion for Hugging Face, which hosts one of the largest collections of open AI models. Hugging Face had reportedly rejected a $500 million Nvidia investment last year at a $7 billion valuation because it did not want one dominant investor shaping the platform.
The reported price is about 86 times Hugging Face’s estimated $150 million annual revenue. Nvidia already controls most AI chip sales, and owning the place where millions of developers download models gives it another way to steer those models toward Nvidia hardware and cloud services.
https://www.channelnewsasia.com/commentary/nvidia-hugging-face-ai-openai-chips-6347461
Claude Fable 5.1 is here
Anthropic released Claude Fable 5.1 and Mythos 5.1 as the same underlying model with different safeguards. Fable is generally available. Mythos is restricted to trusted access programs for advanced cybersecurity and life science work.
Fable 5.1 is estimated to cost 25% less than Fable 5 on typical workloads, with savings up to about 45% for agent-heavy work because cache reads are cheaper. Anthropic says it also cut false positives in cyber safeguards by 60%, while still blocking exploit development.
Anthropic now sells capability and access rules separately, even when the model underneath is the same.
https://www.anthropic.com/claude-fable-and-mythos-5-1
Meta gave Muse its own computer
Meta launched Muse, a personal agent that keeps working after you close the app, can fill forms, book travel, send email, and make purchases after approval. It runs inside a dedicated cloud computer with a separate Sentinel agent checking anything that reaches the internet.
Muse can use one-time cards from Stripe Link so it never sees the real card number. Meta says conversations and data in the virtual machine do not feed its ad systems, and a version encrypted with a user-held key is coming later this year.
Muse is free for most tasks and is rolling out in the US across iOS, Android, WhatsApp, and its website.
https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent
🕵️ Undercovered
One operator used AI across an entire cyber campaign
Anthropic says a Russian state-linked operator used AI to rebuild malware when security tools detected it, set up phishing infrastructure, steal cloud email, process hundreds of gigabytes of data, and keep access to compromised accounts. The campaign targeted more than 20 organizations, including Ukrainian government bodies, drone makers, embassies, and defence groups.
The same operation compromised hotel WiFi vendors to redirect guests, took over WhatsApp accounts, and stole more than 300,000 national identity records from a North African government authority. Humans still picked the targets and reviewed stolen data, but the agents handled much of the work between those points.
https://www.anthropic.com/threat-intelligence-report-september-2026
Google mapped 9 billion DNA changes
Google DeepMind released AlphaGenome Atlas with predictions for every possible single-letter change in the human genome. The dataset is about one petabyte, more than 30 times larger than the AlphaFold Database, and academic researchers can use it for free.
In early work, researchers used it to uncover 22% more non-coding genetic associations in UK Biobank data and identify a missed variant linked to epileptic encephalopathy. The map still predicts which mutations matter, so lab work has to confirm them, but it cuts down the search before that expensive part begins.
Claude can operate lab equipment now
Anthropic opened a research preview of the Model Hardware Standard, a shared way for agents to control microscopes, liquid handlers, robot arms, and other programmable equipment. Anthropic says integrations that usually take weeks or months can drop to hours or minutes.
In a Genentech test, Claude coordinated three machines for a protein assay, changed liquid flow rates after reading the results, and recovered from some hardware failures. It still needed human help when bubbles confused the liquid handler, which is a useful limit to find before anyone leaves the lab running overnight.
https://www.anthropic.com/news/model-hardware-standard-research-preview
Abu Dhabi released the training data too
MBZUAI’s Institute of Foundation Models released six K2 Horizon models from 0.9 billion to 375 billion parameters. The release includes weights, code, training data, and methods under Apache 2.0, which is much more open than the usual open-weight launch.
The smallest model is meant for watches and glasses, while the largest activates 23 billion parameters per request. IFM also says its block-based generation method makes output roughly three times faster without lowering quality.
🗄️ The Vault
Life Recorder
An open-source iPhone app that records audio in one-minute chunks and sends it to a Mac for local Whisper transcription. The Mac keeps one continuous Markdown file, then deletes each audio chunk after it is safely received and transcribed. There is no cloud backend or paid transcription service.
https://github.com/browser-use/life-recorder
OpenWhispr
A free, open-source dictation and meeting app for macOS, Windows, and Linux. It can transcribe fully offline with Whisper or Nvidia Parakeet, paste speech into any app, label speakers in meetings, and send voice commands to local or cloud models.
https://github.com/OpenWhispr/openwhispr
Edge0
Edge0 runs sparse models on Apple Silicon by keeping only active experts in memory and streaming the rest from SSD. Its 35B model peaks around 2.9GB of active memory on short contexts, while the 8B version uses about 1GB, though the model files still need 23GB and 4.2GB of disk space.
https://github.com/Edge0-AI/Edge0
Link CLI
Stripe’s open-source CLI gives agents one-time payment credentials after the user approves a purchase. It can issue a virtual card that works outside Stripe, while keeping the real card number out of the agent’s context and logs. It is limited to US Link accounts for now.
https://github.com/stripe/link-cli
VoxCPM2
An Apache-licensed speech model with 30 languages, voice design from a text description, and voice cloning from a short sample. It produces 48kHz audio, can stream in real time, and ships with local serving paths for Nvidia GPUs and Apple Silicon.
https://github.com/OpenBMB/VoxCPM
🔥 This Week’s Pick
Your prompts keep travelling
Two separate stories this week exposed where prompts can travel.
Anthropic says people using Kimi and DeepSeek had some requests sent to Claude without being told. Those prompts crossed products, companies, and borders before the answers came back under a different model’s name.
OpenAI’s Navier-Stokes announcement raised the other side of the problem. A researcher used Codex during private work, then OpenAI produced a closely related result and said it could not rule out de-identified product data helping improve its models.
These are allegations with disputed details. But to be fair, the privacy controls most people understand are about training. They say much less about routing, evaluation, abuse monitoring, or de-identified product improvement.
Most privacy controls still do not explain who receives a prompt, how it is routed, or whether de-identified usage can improve another model.
https://www.anthropic.com/threat-intelligence-report-september-2026
🧪 This Week’s Experiments
Put one fake secret into a low-stakes agent workflow and check every log, provider, and router that receives it.
Run Edge0’s 8B model on an Apple Silicon Mac and see whether SSD streaming feels usable on a real coding task.
Try Life Recorder for one hour at home, then decide whether a local transcript is useful enough to justify recording that much of your day.
Check which AI tools you use can keep prompts out of training, routing, human review, and retained logs, because those are four different settings.