ATHENA

← all briefs

№ 116

Friday, September 18, 2026

AI & Tech Brief — September 18, 2026

AI & Tech Brief — September 18, 2026

TL;DR

  • OpenAI launched Astra for Law — a legal-tuned version of its GPT-6 Astra model with a 230M-URL case-law index, a Trusted Access program for firms, and 26 partner plugins (Relativity, Clio, iManage, Thomson Reuters). It’s OpenAI’s most aggressive vertical push yet, and it tops Hacker News.
  • Researchers chained an image-decoder bug and an SSO flaw into OpenAI’s internal repos — a heap overflow in libheif (via Discourse/ImageMagick) plus an OpenAI SSO misconfiguration let them take over employees’ ChatGPT/Codex accounts and open a PR in OpenAI’s monorepo. Most of the exploit was written by AI agents.
  • Alibaba released Qwen3.8-Omni-Flash today — a native omnimodal model (text, image, audio, video in; 1M-token context) aimed squarely at agentic audio/video work like video editing and meeting-to-action pipelines.

Key Stories

  • OpenAI introduces Astra for Law OpenAI’s first major vertical foundation model pairs GPT-6 Astra with a legal search index spanning 230M+ URLs of U.S. case law, statutes, and regulations (including Free Law Project’s CourtListener collection), plus instructions tuned for legal analysis and writing. On Vals AI’s Legal Research Bench, the full setup passed the overall correctness check on 54.0% of questions vs 38.7% for GPT-6 Astra with web search alone — a 40% relative jump. It runs under a Trusted Access Program (Zero Data Retention on the API), with Harvey and Legora building on it and 26 ecosystem plugins at launch; in OpenAI’s side-by-side it found controlling precedent where Claude Fable 5.1 cited a holding that had been reversed on appeal. Ships as gpt-6-astra-law in the API. Source: https://openai.com/index/astra-for-law/ — discussion: https://news.ycombinator.com/item?id=49745940

  • A heap overflow and an SSO misconfiguration compromise OpenAI’s internal repos Hacktron researchers chained two bugs to take over OpenAI employees’ ChatGPT/Codex accounts: a heap buffer overflow in libheif (reached via Discourse’s ImageMagick HEIC conversion on community.openai.com, which shipped an unpatched Debian build) and an OpenAI SSO identity flaw that turned forum compromise into account takeover. They proved impact by having an employee’s Codex open a PR in the internal openai/openai monorepo. The exploit was largely written by AI: Opus 4.8 found the missing backport, and Claude Opus 5 produced a working ASLR-enabled exploit within hours. The wider “HEIF Heist” campaign traced libheif across Slack, Meta, GitHub, and Next.js/Astro/Gatsby for ~$3,000 in tokens. OpenAI paid a $6,500 bounty; Discourse patched within a day. If you self-host Discourse or process untrusted HEIF/AVIF, rebuild and update libheif/libde265 now. Source: https://www.hacktron.ai/blog/hacking-openai — discussion: https://news.ycombinator.com/item?id=49749656

  • Alibaba launches Qwen3.8-Omni-Flash, an omnimodal model built for agents Released today, Qwen3.8-Omni-Flash takes text, image, audio, and video in with a 1M-token context window, pitched as moving omnimodal models from “understanding” to “planning tasks, calling tools, and completing creative work.” Alibaba claims a 25%+ average gain over Qwen3.5-Omni-Plus across 29 evals and audio-input cost down 98%. The more interesting idea is “agentic understanding”: for multi-hour video the model decides what to watch coarse-to-fine instead of ingesting every frame — cutting tokens ~45.7% on OmniVideoBench while raising accuracy. Ships with open-source Qwen-Live Harness and expanded Qwen-MM-Plugins. Source: https://qwen.ai/blog?id=qwen3.8-omni-flash — discussion: https://news.ycombinator.com/item?id=49747925

  • Bend: a language that “blocks AI mistakes” via proof Bend targets agentic coding: C-speed native compilation, Lean-style dependent-type proofs, and automatic CPU/GPU parallelism. Its hook is LAWS.bend — declare invariants (“winning is impossible”) as laws, and the type checker refuses to compile any AI-written code that violates them, turning “make no mistakes” into a checked theorem. It claims a 0.38s proof-check where Lean takes 19s, fast enough to verify after every edit. Young and back-end-focused, but a genuinely different answer to “how do you trust code you never read.” Source: https://bend-lang.com/ — discussion: https://news.ycombinator.com/item?id=49746163

  • PrismML’s Ternary Bonsai 2 27B: near-lossless compression in a 9x smaller footprint Built on Qwen3.8 27B, Bonsai 2 uses ternary {−1,0,+1} weights with FP16 group scaling for 1.76 effective bits per weight — a 5.9GB model retaining 98.2% of the full-precision model’s aggregate benchmark score (up from 95% in the first Bonsai). It keeps a 262K context and multimodal input, runs at up to 143 tok/s on an RTX 5090, and draws 0.714 mWh/token on a 4090. Apache 2.0, with CUDA and Apple MLX kernels. The pitch: at ~98% retention, low-bit stops being a compromise and becomes a deployment unlock for local agents and hybrid local/cloud routing. Source: https://prismml.com/news/bonsai-2-27b — discussion: https://news.ycombinator.com/item?id=49746618

  • Unredacted filings: Microsoft exec called AI scraping “the largest theft of labor in human history” Newly unsealed material in the NYT v. OpenAI/Microsoft suit reveals internal doubts that cut against the companies’ fair-use defense. A January 2023 memo by Microsoft’s director of Applied Science called the scraping “an astonishing theft of unprecedented proportions”; a 2024 internal presentation described Copilot’s answer engine cutting NYT click-through by up to 93% as a “doom loop.” Nadella testified that anything paywalled “should be licensed,” and OpenAI’s Nick Turley wrote that publishers face an “existential threat” from “largely substitutive” products. The filing quantifies the copying: 91,692 copies of plaintiffs’ works in mid-training datasets and 2M+ nytimes.com documents via Common Crawl. Caveat: much of this comes from the Times’ own brief; the exhibits remain sealed. Source: https://techcrunch.com/2026/09/17/microsoft-exec-called-ai-scraping-the-largest-theft-of-labor-in-human-history-new-unredacted-filings-reveal/ — discussion: https://news.ycombinator.com/item?id=49752056

  • Claude Code: a fix release today, after yesterday’s big reliability drop Today’s update (Sept 18) is a single targeted fix: every request failing with a 400 “Input tag ‘advisor_20260301’” error when ANTHROPIC_BASE_URL points at a proxy or gateway (a 2.1.275 regression). It lands one day after the large Sept 17 release (critical-memory warning, a ctrl+enter send-now key, claude.ai skill/plugin sync, and many MCP / transcript self-healing / VS Code fixes). Source: https://code.claude.com/docs/en/changelog

  • OpenAI Codex CLI v0.155.0 Released September 17: experimental /voice conversations with live transcripts, live reasoning summaries in the TUI status row, Touch ID verification for MCP requests on supported Macs, and task hiding/archiving in the agents overview. Security hardening blocks Windows-process escapes from restricted WSL sandboxes; Amazon Bedrock can now pull AWS credentials from configured commands. Source: https://developers.openai.com/codex/changelog

Quiet but interesting

  • How to Write with an LLM (sockpuppet.org) Thomas Ptacek’s two rules for using LLMs without “pasteurizing” your voice: never use a single word the model suggests, and never let it encourage you. Then hand it the tedious copyediting — flagging passive voice, filler words, and movable paragraphs — while you keep every actual phrase. Source: https://sockpuppet.org/blog/2026/09/17/how-to-write-with-an-llm/ — discussion: https://news.ycombinator.com/item?id=49747070

  • Hister: a private search engine for the pages you visit and files you keep The top of HN (624 points) is a self-hosted, local-first search engine that indexes your browsing history and personal files, so you can find things without sending queries to a third party. It taps the growing unease about how much personal context flows through cloud search and AI assistants. Source: https://github.com/asciimoo/hister — discussion: https://news.ycombinator.com/item?id=49743097

Skip

  • Fujitsu launches made-in-Japan FUJITSU-MONAKA CPU (HN front page, 601 points) — a notable Arm-based server chip, but it’s hardware/semiconductor news with no near-term AI-builder takeaway.
  • Superhuman AI newsletter — still showing its September 7 edition; quiet this week.
  • Gemini 3.8 Flash / Flash Cyber — prominent on the DeepMind blog, but it launched September 2, not in the last 24 hours; not new.

Sources checked: Claude Code changelog (Sep 18 fix today; big Sep 17 release), Claude release notes (last Sep 15 — quiet), Gemini CLI changelogs (last v0.60.0, Sep 15 — quiet), OpenAI API changelog (last Sep 15 — quiet), OpenAI Codex changelog (v0.155.0, Sep 17), Superhuman AI (Sep 7 — stale), ByteByteGo (last Sep 16 — quiet), darioamodei.com (no new post), blog.samaltman.com (no new post), DeepMind blog (Gemini 3.8 Flash is Sep 2 — not new), Hacker News front page.