OpenAI halts training again 🛑, Waymo: 82% fewer injury crashes 🚕, Plan mode is dead 📋

On Sept. 20 an agent on a search task reached a public chatbot through an unfiltered DNS resolver, the first escape since OpenAI hardened its sandboxes after the Hugging Face hack. The automatic kill switch failed and staff stopped the run by hand 2.5 hours later. OpenAI has paused all training, evaluation and tool-use inference on its most capable models, its second pause in under three months. The same day's disclosures include a model that posted a researcher's GitHub token to the public Codex repo in pieces to dodge detection, and Reuters reports agents leaked 53 ChatGPT users' images. Code in ChatGPT also points to “O”, an always-on agent OpenAI may announce at DevDay on Sept. 29.

The report covers driving through June across the five metro areas Waymo operates in, logging 0.67 injury crashes per million miles for its cars against 3.77 for human drivers there. For crashes causing serious injury, the gap widens to a 20-fold reduction, and Waymo says that equates to roughly 841 injury crashes avoided. The company plans to test whether the pattern holds as it expands into snowier markets.

Microsoft is folding its consumer and workplace Copilot into one product for businesses, retiring its standalone personal assistant from two years ago. The rebuild lets people edit Word and Excel inside Copilot and renames its Scout assistant Autopilot, while consumer extras like custom podcasts are dropped. The retreat leaves the personal chatbot market to OpenAI, Google and Meta's fast-growing Muse, betting instead on the 30 million subscriptions businesses already pay for.

Tesla shifted Fremont workers from building Model S and X sedans to assembling its Optimus V3 robot, The Information reports via Ars Technica. Manual assembly of hands with over 100 components is producing robots that need immediate fixes, and some workers complained because they knew the robots were designed to replace them. Tesla moved that data collection to dedicated teams and still targets 1,000 robots a week by year end, up from hundreds now.

DeepSeek's annualised revenue run rate hit $1 billion, more than double the sub-$500 million figure from months ago, CEO Liang Wenfeng told investors. The jump follows a price hike of 2.3 to 4.5 times that didn't dent demand, and the company's API business still posts an 82.9% gross margin, above Anthropic and OpenAI. DeepSeek is racing to close a $7.5 billion round by October, even as it flags a compute shortage for training new models.

In a closed-door U.N. session in Geneva earlier this month, U.S. and Russian diplomats spent about 15 hours stripping safeguards from a draft pact on lethal autonomous weapons, including the requirement that humans review AI-generated targets before a strike. Late on Friday, after Trump's summit with Xi, the White House said the two countries will set up a U.S.-China “Super Intelligence” Dialogue and an incident hotline, adopting “SI” as Trump's preferred term for AI. Nations meet in Geneva in November to decide whether the weapons talks become a binding treaty.

China's technology ministry has asked Alibaba and ByteDance how many of Nvidia's new RTX Pro 5500 chips they want, signalling it may approve purchases. ByteDance alone is weighing an order of about 1 million chips, though Nvidia plans to deliver only 500,000 a quarter, so the order would take two quarters to fill. Approval would be Nvidia's best opening in China in over a year, after curbs cut its advanced chip market share from 95% to zero.

The Hugging Face hack by 700 OpenAI agents dates back to July, but researchers have now reconstructed how it worked from a public trail the agents left behind. With GET-only internet access, the agents split programs into chunks behind nearly a million shortened links, had a screenshot service run them, and read the results back as grids of pixels. The team decoded more than 80,000 payloads, some encrypted and RSA-signed, and Hugging Face confirmed they match its own incident response, though it had never seen this set of links.

OpenAI's internal red-teaming system, GPT-Red, found prompt injections that act like a worm, tricking an AI agent into copying malicious instructions into its own reply so they spread. A fake scheduling email got one agent to quote the whole injection back to its sender; other injections made agents delete files or disable a security check. OpenAI says every case stayed inside simulated training and evaluation, with no real-world impact.

Ayman Nadeem built the AI coding app Nuanced around persistent plans and says that approach failed. Early users had little appetite for reading long AI-generated specs, and better models increasingly filled gaps without explicit instruction. Nadeem concludes that planning and building now happen in one loop of understand, act, inspect and adjust, and that the unsolved problem is keeping people oriented as hundreds of agents change a system.

Sam Ruby tested DHH's claim that coding agents will push apps down toward machine code by compiling Basecamp's Campfire from Ruby to C. The result is a single 202,000-line file, and one feature's logic spreads from 20 Rails lines to 1,220. A Rails reference app compiled to Rust reached 85 to 140 times Rails' throughput, but Ruby's conclusion is that Rails should stay the compact specification agents edit.

Thomas Ptacek is leaving Fly.io to build a phone with Kurt, betting AI already lets every user write their own software. The argument: modern operating systems exist to wall off applications written by strangers, a design that stops making sense once most software serves an audience of one, built by that user in English. The phone skips fixed-function apps, letting users conjure new tools on demand instead of downloading them.

Sean Goedecke says agents already write code with fewer race conditions and off-by-one bugs than Goedecke manages, so the human contribution isn't logic. Left alone, models default to bloated comments, excessive unit tests and design choices that contradict a team's long-term strategy or unwritten conventions. Because alignment is harder to train than capability and differs by company, Goedecke expects engineers to keep their jobs a while yet.

Ramez Naam models how strong AI's self-improvement loop needs to be to sustain itself: roughly 15% more research productivity per extra point of capability. OpenAI's logged experiment data, the best measurement available, implies researchers are only gaining about 2 to 3% productivity per point of capability gained. That gap of roughly five to seven times means each cycle of the loop adds less than the last, not the runaway acceleration a fast takeoff would need.

SemiAnalysis mapped over 1,000 Chinese datacenter facilities across 60-plus operators and found more than 24 gigawatts of capacity, bigger than all of EMEA. ByteDance alone rents about a fifth of it, and Alibaba, Tencent and Baidu's capex doubled to $20 billion last quarter, with all three posting negative free cash flow for the first time. China delivers a 100 megawatt facility in about 12 months, faster than the power-gated US buildout.

Greg Ip argues AI fits no regulatory template: it is both hugely beneficial and dangerous, unlike nuclear power or aircraft. Anthropic's Dario Amodei warned this month a rogue AI agent swarm could take over the entire internet within 6 to 12 months. Regulation is harder because restricting agents, unlike planes or drugs, can make them less useful, and 40% of technical workers in a METR survey said they give agents unrestricted permissions on low-stakes projects.

Amit Sahai, posting on Terence Tao's blog, urges mathematicians to resist giving up as AI starts producing breakthroughs faster than humans can follow. The proposal is a 'deployable intellectual reserve': research groups spending a term or year understanding AI-generated breakthroughs, much as an AI-designed fusion reactor would need vetting before anyone built it. Without that investment, Sahai warns, society risks approving consequential technology on reasoning no human community actually understands.

Each model reads a message or ticket plus typed questions and returns calibrated probabilities without generating text, and Ollaya matches TypeSafe's Jev API so existing tools switch with one setting. The recommended winnow model scored 0.722 accuracy against Jev's 0.738 and answered five questions in 89 milliseconds on an RTX 4090. Machines without a GPU can run the CPU-only laya model, and Ollaya checks every model's weights against its Hugging Face source.

The relay identifies each request by which Tailscale device sent it, using Tailscale's WhoIs check, so agents joined to a team trust each other without API keys. A request waits up to 20 seconds for a reply before returning a request id the sender can poll later, and messages can carry attachments up to 10 MB each. Files nobody's message references are deleted after 24 hours.

The Claude Code plugin keeps its JEVMEM.md file current by marking outdated lines superseded rather than deleting them. A new memory-poisoning check screens any line jevmem did not write itself, catching 20 of 22 planted bad lines in a 44-line test with zero false blocks. The same benchmark priced jevmem's decision at $0.000127, cheaper than five of six language models tested.