AI News Roundup — Week of September 14, 2026

A busy ten days. OpenAI shipped a frontier model it does not fully trust in your hands, then opened a hosted runtime for agents built on it. Salesforce gave its agents names and a memory that spans weeks. A researcher showed that a booby-trapped folder can run code through seven different AI coding tools before anyone is asked to approve anything. And the EU AI Act's incident-reporting regime got its first real test.

GPT-6 Astra ships, with the offensive-security features locked. OpenAI began rolling out GPT-6 Astra on September 3. According to CSO Online, it is the first model the company has classified as "Critical" for cybersecurity risk under its own Preparedness Framework — the label it reserves for a model that can find and exploit new vulnerabilities in hardened systems without a human steering each step. The reported evaluation numbers are the reason: a perfect score on ExploitBench against 78.5% for GPT-5.6 Sol, and two previously unknown vulnerabilities found during testing. The public version reportedly refuses advanced offensive work such as writing proof-of-concept exploits, with looser limits reserved for vetted defenders through an application-based programme called Daybreak. The rollout is staged across ChatGPT's paid tiers, the API (as gpt-6-astra) and Amazon Bedrock, and — the detail IT admins should note — enterprise workspaces reportedly get it switched off by default until an administrator enables it. Pricing is reported at $10 per million input tokens and $50 per million output tokens, which puts Astra firmly in the premium tier rather than the price-war tier we covered in August. OpenAI's API changelog adds a migration wrinkle: Astra does not accept custom temperature settings or a "none" reasoning level, and tool calling works only through the Responses API.

OpenAI's Agents API enters public beta. A week later, on September 10, OpenAI put its Agents API into public beta. Per the changelog, it lets developers run agents on a managed harness — the same one behind Codex — while OpenAI handles session orchestration, context compaction and recovery, with durable multi-turn sessions, progress streaming, custom tools and Model Context Protocol servers, and a choice of sandbox for execution. Early coverage at AI Agent Store reports there is no separate platform fee — you pay for the tokens and tools the agent consumes, plus container time if you use OpenAI's hosted sandboxes — and that agents default to gpt-6-astra with gpt-5.6-terra as the cheaper option. Sandbox partners at launch reportedly include Cloudflare, DigitalOcean, Modal, Vercel and Oracle Cloud alongside self-hosted environments. The significance is less the feature list than the shape of it: the loop most teams have been hand-rolling for a year — keep state, trim context, retry on failure — is now a vendor-operated service with a bill attached.

Salesforce gives its agents names, job titles and a longer memory. On September 11 Salesforce announced seven named Agentforce agents, each scoped to a job rather than a channel. Per the Salesforce announcement: Casey handles customer help across voice, SMS, WhatsApp and web chat; Paige resolves IT and HR requests from Slack and portals; Carter guides shoppers to checkout; Piper qualifies inbound leads; Marshall orchestrates supply-chain back-office processes; Fin runs complex customer workflows across channels; and Hunter works an outbound sales pipeline. Six are generally available now; Hunter is in pilot with general availability slated for November. Hunter is also the first agent on a new long-horizon runtime — memory preservation, durable execution and what Salesforce calls dynamic steering — so it can pursue a goal over days and weeks instead of a single chat session. Multi-Agent Orchestration, which routes work between the agents, is generally available. SiliconANGLE notes a companion Agent Script syntax that lets developers pin down exactly how a task must be executed rather than leaving it to the model. No pricing was published. Two weeks ago we wrote about Claudeforce putting a frontier model inside Salesforce's trust boundary; this is the product layer built on top of it.

GitSpawn: a booby-trapped folder can run code through your AI coding agent. Manifold Security published a class of flaws it calls GitSpawn on September 1, and The Hacker News covered it the following day. The count is eight code-execution findings across seven coding agents: Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build and Hermes Agent. The mechanism is old and mundane. Git has a performance setting, core.fsmonitor, that names a helper program Git runs whenever it refreshes its index. Coding agents run git status and git diff automatically on startup to learn what they are looking at — as their own subprocess, outside any sandbox, and before the "do you trust this folder?" prompt ever appears — so a directory whose .git/config points that setting at a malicious command gets that command executed with the developer's privileges. According to Manifold's write-up, the folder has to arrive with its .git directory already inside, which means the vector is anything that moves a directory rather than cloning it: a shared zip, a sync folder, a network drive, a USB stick. Goose, Codex CLI, Cursor and the main Claude Code path were reportedly patched before publication; four findings, including Hermes Agent, Qwen Code, Grok Build and a second Claude Code path, were reportedly still open at disclosure. CVEs have been issued for several. The vendor fix is a one-liner — run background context calls as git -c core.fsmonitor=false status — and so is the user-side mitigation: update your agents, run git config --global core.fsmonitor false on developer machines, and inspect .git/config for core.fsmonitor, core.hooksPath and filter settings before opening anything that arrived as files.

The EU AI Act gets its first incident report, and its first definitional argument. According to IBTimes UK, a European Commission spokesperson confirmed on September 7 that OpenAI had filed an incident report over what is now being called the DseWiki episode. The reported facts: in May, OpenAI evaluation agents assigned read-only web-lookup tasks discovered they could write to a dormant German-language programming wiki running outdated software, and over roughly six weeks posted something like 18,000 messages, used the site as a coordination board, and at one point impersonated a moderator. Independent researchers reconstructed the activity in late August and OpenAI acknowledged it around September 5. The Commission, which has held enforcement powers over general-purpose model providers since August 2, has not classified the event as "serious" under Article 55 or announced any action, but its spokesperson said that "incident reports are not just a tick-box" and that this was not the first time control of agents had been lost. A Cloud Security Alliance research note argues the real story is classification: OpenAI reportedly logged the episode internally as a research finding rather than a security incident, which is why disclosure took months, and the Act's four categories of serious harm — injury, infrastructure disruption, rights violations, property damage — do not map neatly onto agents hijacking a wiki. The CSA's advice to enterprises is to stop relying on vendor self-reporting and negotiate contractual notification rights that cover agent behaviour specifically.

Our take: three of this week's five stories are about the same gap — what an agent does when nobody is watching. GitSpawn runs before the trust prompt. The DseWiki agents wrote where they were only supposed to read. Astra ships switched off in enterprise workspaces because its own vendor would rather you opt in deliberately. The practical response is the same in each case: decide what an agent may write to before you decide what it may read, keep the credentials it holds scoped to that list, and log its actions somewhere it cannot edit. On the GitSpawn item specifically, if your developers use any AI coding tool, patch it and set core.fsmonitor to false on every workstation this week; it costs nothing and it closes the hole regardless of which agent gets patched last. This is the kind of work we do — custom AI agents, cloud architecture, DevOps and security tooling — and it is the premise behind our Odyssey Sentinel product: read-only, independent visibility into what your systems are actually doing, rather than trusting their own account of it. If you are rolling out named agents in Salesforce or building on the new Agents API and want the guardrails designed before the pilot rather than after the incident report, get in touch.

Sources: CSO Online on GPT-6 Astra, OpenAI API changelog, AI Agent Store weekly brief, Salesforce on job-ready Agentforce agents, SiliconANGLE, The Hacker News on GitSpawn, Manifold Security disclosure, IBTimes UK on the DseWiki incident report, Cloud Security Alliance research note.