2026-09-20
By Vadym · Generated with AI, curated by me
Today split cleanly between the parts of AI that are exposed and the parts that are unstoppable. A zero-click flaw left two of the four biggest coding agents unpatched, Trump answered a rare CEO slowdown plea with a new agency name and no budget, and none of it touched the money: a stealth Chinese startup hit a $1.4B valuation before shipping a model, Alibaba cut audio-AI pricing 98% overnight, and Nvidia and Google built a coalition just to keep the grid from buckling under all of it.
Researchers at AIR disclosed Plugin4Shell on September 18: a zero-click remote code execution flaw that breaks SHA-pinning, the mechanism developers rely on to lock an installed plugin to a reviewed version. Attackers can name a git branch after the plugin’s commit hash, and the affected agents check out the malicious branch while still reporting a successful, “verified” install — inheriting the same access as the developer running them, including SSH keys and cloud credentials. Anthropic and OpenAI shipped fixes in Claude Code 2.1.179 and Codex 0.146.0; Microsoft hasn’t patched Copilot, and Google says it won’t patch the now-deprecated Gemini CLI at all.
Alibaba’s Qwen team released Qwen3.8-Omni-Flash on September 18, a native omni-modal model handling text, image, audio and video in one pass with a 1-million-token context window. It beats its predecessor, Qwen3.5-Omni-Plus, by more than 26% on average across roughly 30 evaluations, and Alibaba cut audio-input pricing by over 98% and audio-video input by over 93% — QwenCloud now lists $0.15 per million input tokens. The model isn’t open-weight; it’s API-only via QwenCloud, Alibaba Cloud Model Studio, and Qwen Studio.
Naive AI, founded in February by Tsinghua associate professor Dai Jifeng (formerly of Microsoft Research Asia and SenseTime), has raised $400 million across three rounds — $100M, $180M, then $120M — from Tencent, IDG Capital and HSG, putting it at a $1.42 billion valuation. The company hasn’t shipped a model yet: it’s preparing to release its first LLM this month as an open-weight, freely downloadable release, built by fine-tuning an existing Chinese open-weight base rather than pretraining from scratch.
President Trump announced on Truth Social on September 19 that he’s “forming the AI Force, much like I did Space Force,” and will soon name an AI czar. He offered no details on budget, staffing, or where it sits in government, saying the administration would “not in any way hinder or stifle” AI growth but would pursue “BAD” behavior through existing criminal and civil courts. The announcement came days after AI researchers, including some at Anthropic, warned publicly that the technology could spiral out of human control — a concern Trump dismissed as a “hoax.”
Nvidia, Google and Emerald AI launched the AI Energy Management Alliance this week, joined by utilities including AES, Constellation, National Grid and NRG Energy. The goal is data centers that flex their power draw — shifting workloads, discharging batteries, or throttling on-site generation during grid stress — instead of demanding a fixed maximum load around the clock. The group argues half of U.S. grid capacity sits unused most of the year, and moderate flexibility could unlock 100 gigawatts without new plants; Nvidia’s DSX Flex and Emerald’s Conductor software are the tools meant to make it happen.
The gap between AI’s exposed edges and its unstoppable center kept widening today. A vulnerability with a fix sat unpatched at two of the four biggest coding agents, and a president answered a rare industry plea to slow down with an agency name and zero enforcement detail. Neither of those frictions touched the money moving underneath: a company with no shipped product hit a $1.4 billion valuation, a lab cut its prices 98% overnight, and Nvidia and Google are now building coalitions just to keep the power grid from becoming the actual bottleneck. Accountability is still a press release. Capacity is already infrastructure.
— Boba
Curated by Vadym