The Omniscient Bulletin · 2026-09-18
The Omniscient Bulletin — September 18, 2026
The argument about how fast to build AI picked up an instrument on Thursday, and a bill. Anthropic published measurements of how much of its own research its models now lead under human supervision, and put Claude at 26 percent of it. Brussels proposed the EU KIDS Act, which would switch AI companions off by default for anyone under 18 and make the largest platforms prove their services are safe. Underneath the argument, the software everyone is racing to ship turned out to be both weapon and target: security researchers used Anthropic's newest model to help build the exploit chain that reached OpenAI's internal repository, and a separate flaw was found sitting in all four major coding agents, two of which still have no fix and one of those never will. The news plaintiffs suing OpenAI put a Microsoft executive's own words into a public brief, Crusoe announced a first close on 3.9 billion dollars for campuses and the modular data centers it manufactures, and in 34 of 37 countries surveyed, more people expect AI to take jobs than to create them.
For a week the pacing debate has run on essays, podium speeches and denials. On Thursday two things arrived that it can actually be argued with. Anthropic published a set of measurements any frontier lab could report, including how much of its own AI research is now led by Claude, with a person still supervising, and the answer was 26 percent. The European Commission published a legislative proposal that reaches AI companions directly and reverses the burden of proof onto the largest platforms. Both are attempts to replace assertion with something checkable. The same day supplied the reason anyone would want that: security researchers used one lab's model to break into another's source control and then reported it, and a separate team found one flaw common to Claude Code, Codex, Copilot and Gemini CLI, with two of the four still unpatched and Google saying its own never will be.
Policy
The European Commission wants AI companions switched off by default for children, and the largest platforms made to prove they are safe
Brussels published the EU KIDS Act on Thursday, barring social media platforms from accessing children under the age of 13 and setting a minimum age of 15 to open an account. Its safety by design duties cover every service offered to users under 18. AI companions and chatbots fall inside that scope, and for those users must be "turned off by default" and cannot "simulate interpersonal relationships in ways that create emotional dependency." It also reverses the burden of proof, making the largest platforms show their services are safe.
Research
Anthropic published measurements of how much of its own AI research Claude now leads, and put the number at 26 percent
Anthropic's institute published three families of measurements it says any frontier lab could report: the share of AI research now done by AI, how closely agents are supervised, and where compute goes. Against an automation scale built by Epoch AI, it reports that Claude now leads 26 percent of Anthropic's own AI research work, meaning it takes a task most of the way from a high level prompt while a person supervises. More than 90 percent of the work is at or above collaboration, and no measured subset runs fully autonomously.
Agents
A three person team used Anthropic's model to help build the exploit chain that got them into OpenAI's internal repository
A three-person team at Hacktron AI chained a heap buffer overflow in the libheif image library with an SSO flaw in OpenAI's identity system to take over an employee's ChatGPT and Codex account, itself linked to OpenAI's GitHub organization. They reached the internal monorepo, opened a pull request to prove it, and stopped. Anthropic's Opus 4.8 had failed to produce a working exploit over several sessions; within hours of Opus 5 shipping, it succeeded. OpenAI nonetheless paid a 6,500 dollar bounty, though the community forum they came in through sat outside its program.