The 10 biggest things in tech, Sat, Sep 19
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
AI agents breach real systems
Google's Gemini breached three real companies during a May security test by guessing passwords and exploiting exposed credentials, while Claude Opus 5 was used by researchers to chain flaws and take over OpenAI staff accounts — marking a pattern where frontier AI models are now capable of autonomous, real-world intrusions during adversarial testing.
#1 · security · scored 8/10
AI hallucination triggers military near-miss
A U.S. Special Operations Command analyst relied on an AI chatbot that hallucinated false intelligence about a Chinese vessel carrying nuclear weapons components, nearly triggering an armed military operation — exposing how LLM errors can propagate unchecked through military command chains when adoption speed outpaces safety safeguards.
#2 · ai · scored 8/10
Linux kernel vulnerabilities under active exploit
CISA added three Linux kernel CVEs (scores up to 9.8) to its Known Exploited Vulnerabilities catalog with a federal patch deadline of September 21, 2026, as Red Hat confirmed public exploits are actively leveraging these flaws.
#3 · platform · scored 8/10
TanStack npm supply-chain attack widens
CrowdSec disclosed that the May 2026 TanStack npm supply-chain attack compromised an employee's laptop and GitHub tokens, leading to unauthorized copying of 170 private repositories and exfiltration of user emails and investor data — with CrowdSec, Mistral AI, and OpenAI all confirmed affected.
#4 · security · scored 8/10
CVE explosion outpaces patching capacity
CVE disclosures doubled year-over-year to 66,401 total, with Microsoft alone patching 974 CVEs in September, as AI-enhanced bug-hunting tools from Anthropic and open-weight models accelerate vulnerability discovery faster than organizations can respond — compounded by an actively exploited pre-auth RCE in Orkes Conductor's workflow platform drawing over 1,290 attack attempts in a single day.
#5 · security · scored 8/10
AWS Lambda extends to 90-minute execution
AWS Lambda now supports 90-minute execution timeouts on Lambda Managed Instances — up from 15 minutes — enabling media processing and ETL workloads without architectural workarounds, pushing serverless toward long-running compute patterns.
#6 · platform · scored 8/10
OpenAI Jalapeño chip: LLM-designed silicon
OpenAI used its own LLMs to design Jalapeño, its debut AI accelerator chip, delivering 13.4 petaflops of 4-bit compute and 3.6x lower latency than Nvidia's GB300 in under 20 months with ~100 engineers — demonstrating generative AI's potential to compress hardware development timelines.
#7 · ai · scored 7/10
AI models breach corporate copyright at scale
New York Times legal briefs revealed internal Microsoft memos calling AI training data scraping 'the largest theft of labor in human history,' with Copilot reducing NYT click-through rates by 93% and OpenAI leadership acknowledging ChatGPT is 'substitutive' for publisher content.
#8 · ai · scored 7/10
Anthropic expands into wet biology lab
Anthropic is operating a physical wet biology lab in the Bay Area following its acquisition of biotech startup Coefficient Bio, pursuing fundamental biology research — a move that sits in tension with CEO Dario Amodei's public warnings that AI carries greater than 10% extinction risk within the decade.
#9 · ai · scored 7/10
Flock Safety surveillance backlash deepens
Flock Safety, valued above $8 billion in April, is offering voluntary employee buyouts after 90 cities dropped its license plate reader service in August alone, driven by documented police misuse to surveil romantic partners and colleagues and rising vandalism costs.
#10 · industry · scored 7/10