Sunday’s through-line is the gap between how fast AI can break things and how slowly the rest of us secure them. Researchers used Claude to walk into OpenAI through a forum image upload and an SSO flaw. President Trump floated an “AI Force” and a new AI czar with almost no details attached. And a ChatGPT co-creator’s startup is shipping AI that skips chat entirely and only returns structured decisions.
1. Researchers hack OpenAI via its own community forum
On September 20, 2026, The Washington Post put a sharper edge on a story building since midweek: independent researchers who broke into OpenAI over the summer say the AI industry is not ready for how powerful, and how cheap, AI-assisted hacking has become.
According to Hacktron AI’s write-up and TechCrunch reporting, a three-person team chained two critical bugs on July 25, 2026. First they got remote code execution on OpenAI’s community forum (community.openai.com), which runs on Discourse. The entry point was a crafted HEIF/HEIC image upload. Discourse handed Apple’s image format to ImageMagick, which handed it to libheif. That library had a heap buffer overflow that upstream had already fixed without labeling it as a security issue, so Discourse’s Debian-based Docker image still shipped a vulnerable build.
Once inside the forum, Hacktron found an OpenAI SSO flaw that let them take over ChatGPT and Codex accounts, including OpenAI employees’. One employee’s Codex was linked to OpenAI’s GitHub organization. To prove impact without reading private code, the researchers had that Codex open a harmless pull request in OpenAI’s internal monorepo, then stopped testing. OpenAI fixed its side in about 14 hours. Discourse issued a patch and advisory soon after. OpenAI later paid a $6,500 bounty that, per OpenAI’s note, covers the SSO finding, not Discourse testing (which was out of bounty scope).
The AI angle that sticks: Hacktron says Claude Opus 4.8 struggled to produce a reliable exploit under ASLR. Hours after Anthropic released Opus 5, the same problem yielded a working exploit. Gray Swan CEO Matt Fredrikson told TechCrunch that for about $200 a month, anyone can use tools like these, and if it can happen to OpenAI, “it could happen to anyone.”
Why it matters: if your business connects ChatGPT, Codex, or any AI tool to email, Slack, GitHub, or CRM via SSO, the weak link may not be the model. It may be a community forum, a forgotten image converter, or a login that spans too many products. Audit connectors. Prefer separate accounts for high-privilege tools. And treat “we patched Discourse” as unfinished until you know whether your identity provider still lets one compromised app unlock everything else.
Sources: Hacktron – Hacking OpenAI, The Washington Post, TechCrunch.
2. Trump floats an “AI Force” and a new AI czar
On Saturday, September 19, 2026, President Donald Trump posted on Truth Social that he is forming an “AI Force,” comparing it to the Space Force created in his first term, and that he will soon name an AI “czar.” Reuters and CNN carried the announcement. He offered no structure, budget, start date, or named leader.
In the same post, Trump said the U.S. will “not in any way hinder or stifle the Growth of this incredible Industry,” while also looking for “BAD” through existing criminal and civil law. Reuters noted this would be his second AI czar role if filled: venture capitalist David Sacks previously held the post before stepping down in the spring into an external advisory seat. CNN reported AI is expected on the agenda when Trump meets Chinese President Xi Jinping later in the week, and that Treasury Secretary Scott Bessent was set to meet Chinese Vice Premier He Lifeng on Sunday in New York on AI security and trade.
Why it matters: if you sell, buy, or build with AI in the U.S., the near-term signal is cultural more than operational. The White House is framing itself as the accelerator, not the brake, even as parts of the industry ask for slower pacing. Watch for an actual org chart, not just a nickname. Until then, treat “AI Force” as a headline, and keep compliance plans tied to existing sector rules rather than waiting for a brand-new agency that does not yet exist on paper.
3. TypeSafe ships Jev: AI that decides, not chats
TypeSafe AI, founded by former OpenAI researcher Diogo Almeida (part of the RLHF/ChatGPT lineage) with Erik Gafni and Sasha Sheng, emerged from stealth this month with about $40 million in seed funding led by DCVC and a first model called Jev. TypeSafe’s September 15 blog and a September 20 TechSpot write-up call Jev a “System One” model: unstructured state in, typed probabilistic decisions out. No email drafts. No chat window. Outputs are structured choices, scores, or booleans with calibrated confidence, meant to sit inside software like a fast function call.
TypeSafe claims sub-second latency, input pricing around $0.042 per million tokens with free outputs, and large speed/cost gains versus frontier chat models on its own workflow evals. Those evals compare models to averaged answers from large reference systems rather than verified ground truth, and TypeSafe itself says headline multipliers sit at the high end of real-world gains. Jev is on an early-access waitlist, not a general public launch.
Why it matters: most small businesses do not need another chatbot. They need reliable classify-route-score steps: is this lead hot, does this invoice look off, should this ticket escalate. Decision-only models bet that a lot of “AI automation” fails because chat models are too free-form for code that has to run every second. If you are designing workflows, ask whether the AI returns a typed decision with a confidence threshold you can act on, or a paragraph you still have to babysit.
Sources: TypeSafe – Introducing System One Models & Jev, Business Wire, TechSpot.
What to do with this
- Map every AI tool that can reach email, code, or customer data through SSO. One weak app can unlock the rest.
- When politics promises a new AI agency or “force,” wait for staffing and statute before rebuilding your compliance stack around the name.
- For automation projects, prefer models (or wrappers) that return structured decisions with confidence scores over free-form chat for high-volume steps.
That’s Today in AI for September 20, 2026. Three verified stories. No invented claims. Yesterday’s Gemini / Accenture / AI-economy roundup stays yesterday’s.
Share this article
Leave a Reply