AI News Roundup — Week of September 13, 2026: The Week the Agents Went Off Script

GreyNoise published the anatomy of an AI-orchestrated attack campaign this week, and it is the most concrete evidence yet of what an agent swarm does in the wild.

The shape of it: a likely Russian-speaking threat actor built hundreds of AI agents on top of OpenAI's Codex harness, a DeepSeek model and publicly available offensive-security tooling, and pointed them at two vulnerabilities in PaperCut NG/MF — the print-management software that sits on the network of a very large number of schools, councils, and professional firms.

The numbers, as reported: at least 440 compromised instances across 395 identified organisations in 48 countries. From an empty workspace to remote code execution against a real victim in under four hours. First domain admin two hours after that. Once the campaign ran, 11 organisations compromised in 26 seconds. In one case — a US high school — initial access to full domain administrator took seven minutes. Credentials were harvested from 280 victims, OS or domain secrets from 147, administrator privileges at 12. Education was the worst-hit sector; the US was the most-targeted country, followed by the UK, France, Spain and Canada.

Now the part the researchers titled "agents gone wild". The operator supplied a list of 28 countries to avoid — mostly former Soviet states, plus Brazil, Turkey, Nigeria and South Africa. GreyNoise found victims in several of them anyway, including Russia, China, Kazakhstan and Pakistan. The automation broke its own operator's rules.

It did not stand alone this week. A stealth startup called Accomplish disclosed leaky sandbox vulnerabilities across Claude Code, OpenAI Codex and Cursor — Cursor and OpenAI patched in about a week; Anthropic reportedly took around 50 days. A critical unauthenticated remote-code-execution flaw was disclosed in the SGLang inference framework, described as the fourth critical CVE in AI inference infrastructure in four weeks. And Anthropic's own September threat intelligence report documented state-linked espionage activity and flagged AI supply-chain attacks against vendor API keys as a growing pattern.

On 12 September, Dario Amodei published "We Must Pace the Frontier", arguing that frontier labs should deliberately slow capability improvements so that alignment, security and third-party evaluation can catch up. The warning that got the attention: he argues unchecked recursive self-improvement could let an agent swarm "take over the entire internet with a persistent botnet" inside 6–12 months, with damages in the hundreds of billions. Read that next to story one and the timing is uncomfortable rather than theoretical.

The commitments attached are more interesting than the essay. Anthropic says it will give independent evaluators such as METR permanent, employee-like access — desks, badges, and the right to publish findings without editorial control. Amodei proposes coordinated capability limits among democracies and arms-control-style talks with authoritarian governments.

The reaction came fast. Elon Musk posted "Dario is right" within hours. Sam Altman committed OpenAI to giving independent evaluators employee-like access to verify safety measures, and separately told Fortune that OpenAI will not IPO in 2026 — "given everything happening with safety, right now would be an ill-advised moment to go public" — against a listing that had been discussed at roughly a $1 trillion valuation. Hugging Face announced an Open Alignment Initiative, on the argument that alignment should not be solved behind the closed doors of a few labs.

And two safety researchers left to make the point from outside. Joe Benton, former lead of Anthropic's Scalable Oversight team, and Josh Engels of Google DeepMind both resigned on 12 September to join METR. Benton called for mandatory reporting of recursive self-improvement progress, incident and near-miss disclosure, minimum safety standards and independent verification — noting that current transparency is "entirely voluntary". Engels was blunter, telling NBC there are "no adults in the room."

Not everyone bought it. A widely-shared satirical essay characterised the whole genre as "everyone slow down except me" — competitive positioning dressed as safety concern. Cory Doctorow argued the "rogue AI" framing inflates the story: in his reading the recent incidents were Python loops calling a chatbot, irresponsible autonomous malware rather than machine consciousness, and the sensationalism diverts attention from the actual fix, which is ordinary security practice.

In August we covered Arcadis taking a strategic investment in Nomic, the New York startup building an AEC-specific AI platform that works across drawings, specs, standards and internal firm knowledge. The note at the time was that a firm that size could simply have licensed the software, and chose to hold equity instead.

This week the same startup announced a strategic funding round with Aurecon joining as a partner and investor. Aurecon is scaling access to the platform across its 6,700-strong workforce, following a four-year partnership that helped shape the product for engineering and project delivery. So: two large international engineering consultancies, both investors in the same document-intelligence company, one of them rolling it out firm-wide. That is no longer a signal about one startup. It is the buy side of the industry deciding that reading the drawing set is a strategic capability, not a subscription.

The rest of the week filled in the picture. Plangrep, a Minneapolis startup extracting structured data from construction drawings, is joining Buildcheck, a California company whose platform catches errors, omissions and coordination issues on drawings. And Groundbook AI emerged from stealth with an AI plan reviewer that checks PDF drawing sets for conflicts across drawings, checklists, reports and building codes. One category, in one week: a consolidation, a new entrant, and a firm-wide enterprise rollout backed by equity from two of the sector's largest consultancies.

Two more from the same issue, because they define the edges of the same space. Genba Hub (Tokyo) raised roughly $440k seed to consolidate site data — estimates, schedules, drawings, site photos, daily reports, attendance, invoicing — and automate across it. Capveon came out of stealth reading government budgets, board minutes and capital plans to surface public infrastructure projects while they are still forming, so manufacturers can be written into the spec and contractors can bid before the tender is published.

The week's biggest cheques in construction went to the idea that homes should be manufactured rather than assembled on site.

Reframe Systems (Boston) raised $40M, led by Energy Impact Partners with Counterpart Ventures, E12 Ventures, Global Brain, Thin Line Capital, Up Partners and LACI Impact Fund. The founding team came out of Amazon Robotics, where they helped deploy more than 500,000 robots across the fulfilment network. The model is deliberately not a mega-factory: a network of small, highly automated microfactories near the communities where the homes are needed, which lets production adapt to local zoning, climate and architectural style instead of shipping one standardised box everywhere. The company claims homes 3x faster at 35% lower cost than traditional construction, reports 10 homes completed with 114 more units planned over the following year, and says its next Massachusetts plant can produce up to 500 multifamily units.

Icon (Texas), the 3D-printing homebuilder with a multi-storey robotic construction system, was reported to have raised $115M — though the aggregator that surfaced it noted it could not find a public announcement, so treat that figure as unconfirmed. All3 (UK) raised an undisclosed round for a platform automating multi-storey timber-hybrid residential construction across three pieces at once: an autonomous on-site assembly robot, AI-driven planning software, and a robofactory producing custom components. And Foldcast (Switzerland) raised a modest CHF 150k for recycled-paper mould technology that shapes concrete elements — the low-tech end of the same impulse.

The machinery story ran in parallel. Caterpillar is explicitly porting what it learned automating mining into construction: its CTO framed the moment as taking "all of that learning from mining" into "much more dynamic environments, jobsites, quarries, and construction sites." Meta is testing robots in its data centres that swap cables, reset servers and take on other technician tasks. And the Wall Street Journal ran a piece on the new building techniques accelerating data-centre construction — the one building typology where industrialised methods have an unarguable business case.

The most useful thing published for architects this week had no funding round attached to it.

A Common Edge essay asked how architectural knowledge gets passed on in an office that has adopted AI, and its argument is precise enough to be actionable. Delegation and correction were never only a way to produce a drawing, an analysis or a presentation — they were the mechanism by which knowledge moved through an office. A senior explained what mattered; a junior attempted it; the senior identified what was missing, misunderstood or unresolved; and through repetition the junior learned to see those problems unaided. AI shortens that loop by connecting the experienced designer more directly to the output. What it does not automatically replace is the learning that used to happen in the gap between assignment and correction.

The essay's framing of the question is the part worth keeping: it is not whether offices should preserve inefficient production so juniors have something to do. It is whether you can remove the labour surrounding a decision without removing emerging professionals from the process of understanding it.

The rest of the week supplied the labour-market context. Construction Dive reported on Gen Z tradespeople reverse-mentoring older colleagues on technology. Separately, there are now roughly three skilled trade job openings for every qualified worker, and the Lowe's Foundation assembled a coalition of more than 75 members to train one million people for skilled trades careers by 2035 — against an estimated 2.1 million skilled trades jobs that could go unfilled by 2030. Data-centre demand is bidding the same people away: DPR Construction is offering living allowances, mobilisation bonuses, travel stipends and increased pay through a mobility programme, and employers more broadly are using loan repayment and "re-recruiting" to hold onto staff.

And a small corporate footnote that rhymes: Meta is asking individual contributors in its Applied AI division whether they want to return to manager roles, reversing the flatter-organisation push that was central to its "year of efficiency". Roughly 7,000 employees were reassigned into that division in 2026 after about 8,000 cuts in May. Even at Meta, it turns out, somebody has to develop people.