The Signal — September 18, 2026
Three accountings of AI development became public this week, each by a different route. Anthropic volunteered its numbers. A three-person security team published theirs because they thought the industry should see them. The third set had to be pried out of a federal court.
Anthropic published how much of its own research Claude now runs
Anthropic released three internal measurements of how fast AI development is moving inside its own building, along with the methodology behind each one. The headline comes from a prototype it calls the Anthropic R&D Automation Index, built by cataloguing every kind of AI research task at the company, rating how automated each one currently is, and aggregating the ratings. The scale is Epoch AI's, running from AL0, no AI involvement, through AL3, where the model "collaborates" by doing large portions of a task under close human direction, to AL4, where it "leads" by carrying most of a task from a high-level instruction, up to AL5, fully autonomous with no human in the loop.
As of August, Anthropic puts Claude at the "leads" level for about 26% of its AI research and development work. In March that figure was roughly 1%. More than 90% of the work now sits at "collaborates" or above.
The second measurement covers oversight of the agents doing that work: roughly 30,000 running at once on its most-used internal platform, with the real-time monitor blocking about one action in every 47,000 across more than a billion agent decisions in August. The third is a compute snapshot from the week of 13 to 20 July, during which about 6% of compute spent on AI research went to safety work such as alignment, interpretability and red-teaming. Restricted to compute spent on AI-driven AI research, that figure was about 12%.
Every one of these numbers is Anthropic measuring Anthropic against definitions Anthropic wrote, which the company says plainly, along with the observation that no shared cross-lab methodology exists to compare against. The index is a prototype, and Anthropic notes that no measured task is fully autonomous and that humans remain throughout the pipeline. What it is asking for is that other labs publish the same measures, five days after Dario Amodei's pacing proposal arrived without much detail about what implementation would involve. A position paper is easy to revise later. A number with a published methodology, which competitors can contest and which Anthropic says it will keep reporting, is harder to walk back.
Sources: Anthropic · CNBC · Unite.AI
Three people with Claude subscriptions reached OpenAI's internal code
Hacktron AI, a three-person security research team, published a full technical writeup of how they reached OpenAI's internal GitHub monorepo in July. The chain started somewhere unremarkable. OpenAI's community forum runs on Discourse, Discourse processes uploaded images with a library called libheif, and a malformed HEIC file triggered a heap buffer overflow that gave the researchers code execution on community.openai.com.
A forum compromise is a nuisance. What turned it into something else was a second flaw, this one OpenAI's: its single sign-on accepted both direct logins and logins through external services without further checks. That converted a foothold on the forum into takeover of ChatGPT and Codex accounts belonging to anyone who had signed in there, including OpenAI employees, with no interaction required from the victim. Hacktron's writeup is emphatic that this part was never Discourse-specific. Any first-party or third-party service using OpenAI's SSO would have worked the same way.
One of the accounts they reached had a GitHub connection. Rather than read anything sensitive, they used that employee's Codex to open pull request #1186742 in OpenAI's internal openai/openai monorepo, establishing that they had write access, and stopped there. OpenAI shipped a fix about 14 hours after disclosure, revoked the affected tokens and sessions and narrowed token permissions; Discourse published an advisory and added sandboxing for image processing. OpenAI paid $6,500, clarifying that the award covered the OpenAI-side finding because testing against the Discourse-hosted forum sat outside its bug bounty scope.
This was authorised research that escalated further than anyone expected, not a breach, and the monorepo reportedly holds algorithmic material rather than model weights. The detail worth keeping is what the researchers say they used: a cybersecurity-tuned Claude Opus 4.8, then Opus 5, to help build the exploit chain. Hacktron's CTO Mohann Peddhapati put the asymmetry in one sentence, saying they do not have the resources of a state-backed group, they are three people paying for Claude and Codex subscriptions. They chose to stop at a harmless pull request, and the economics they demonstrated do not depend on anyone else making the same choice.
Sources: Hacktron AI · Digital Trends
A Microsoft director called AI training data the largest theft of labor in human history
A Manhattan federal court unsealed a previously redacted plaintiffs' filing yesterday in the New York Times copyright case against OpenAI and Microsoft, and the internal documents it quotes are considerably blunter than anything either company has said in public. The case is three years old. What changed this week is what the court agreed to make visible.
Brent Hecht, Microsoft's director of applied science, wrote in an internal memo that millions of people would soon consider large models "hoovering up" their work to be "an astonishing theft of unprecedented proportions," possibly "the largest theft of labor in human history," adding that almost nobody intended their content to be used this way or was compensated for it. Another internal Microsoft document described what generative products were doing to the web as a doom loop: the products take clicks from the sites they trained on, publishers lose the incentive to keep producing, and the models grow more dependent on material that is no longer being made.
The filing also attaches numbers to the copying. Plaintiffs say OpenAI's mid-training datasets alone hold more than 91,692 copies of works from the Times, the Daily News and the Center for Investigative Reporting, that a Common Crawl-derived dataset included more than 2 million documents from nytimes.com, and that a dataset assembled under an internal effort the filing calls Project Mango contains at least 160,903 unique works from the news plaintiffs. It quotes OpenAI researcher Nick Ryder telling Greg Brockman about a "hack to get around nytimes paywall," to which Brockman replied "ah nice." Satya Nadella testified that paywalled material should be licensed when used for training or grounding, and that he could have required OpenAI to retrain models had he known paywalled material had been scraped. Plaintiffs are separately seeking sanctions over alleged destruction of evidence.
These are selected quotations in a plaintiffs' motion for summary judgment, chosen by lawyers to win an argument, and nothing here has been found as fact by a court. The click-through causation Microsoft's own document describes is exactly what OpenAI disputes. What the filing does establish is narrower and still uncomfortable: the objection publishers have been making since 2023 was being made inside Microsoft at the same time, by people who had seen the datasets, in memos they never expected anyone outside to read.
Sources: TechCrunch · Ars Technica · 404 Media · Chicago Tribune
On the Editor's Desk
Anthropic put out two things worth reading yesterday and we only ran one. The Life Sciences Verification Program opens applications for biology teams to get Mythos, Opus and Sonnet with safeguards tuned to be more permissive for drug discovery and clinical work, which is a genuine milestone rather than a repackaging, and it is on the list for next week. Running it alongside the R&D measurements would have made today's edition an Anthropic newsletter.
OpenAI launched Astra for Law, a configuration of GPT-6 Astra with an index of US case law and 26 legal plugins, with Sullivan & Cromwell and Harvey among early users. Strong story, but its benchmark claim is OpenAI's own, and putting it next to the copyright filing would have crowded two legal stories together. Also held: Pew's survey of 42,151 people across 36 countries finding that 34 of 37 countries expect AI to cost more jobs than it creates, which is solid work with published methodology, but the fieldwork ran from February to May and reads as a snapshot of a mood that has since moved. One more we left alone: InfoQ's piece on GPT-6 Astra being OpenAI's first model classified Critical for cybersecurity is accurate, but the classification happened on 3 September at the Astra launch, so running it under yesterday's date would have meant presenting a two-week-old designation as news.
