AI and IT News Recap: September 14, 2026: Three AI Giants Call for Slowing Down, Fake Passkey Calls Drain Microsoft 365, and a Max-Severity GitLab Flaw Draws Scanners

By Noah Smith, Owner & Consultant, KeyChange Technologies · September 14, 2026

Friday through Sunday turned into one of the strangest stretches the industry has had in a while: the three biggest labs in the world spent it arguing, in public, for going slower. Attackers, meanwhile, had an entirely normal weekend. Here is your AI and IT news recap for September 14, 2026.

📌 The AI and IT news at a glance

• Amodei calls for pacing the frontier, and Altman and Nadella line up behind him inside 48 hours.
• OpenAI quietly confirms it is now serving more than a billion ChatGPT users.
• Fake "update your passkey" phone calls are emptying Microsoft 365 tenants.
• A maximum-severity GitLab flaw is being scanned for within a day of disclosure.
• Florida's DMV database was raided using a police employee's login.
• 347,000 Trezor customers were phished after a breach at email vendor Brevo.
• A Tencent input-method flaw is being exploited to plant the GrayRabbit backdoor.
• Salesforce gave its AI agents names, job titles, and a start date.

🔝 Top story: the frontier blinked

The three biggest labs spent the weekend arguing for going slower

On Saturday, Anthropic CEO Dario Amodei published an essay titled "We Must Pace the Frontier," arguing that the industry needs to deliberately slow the rate at which model capabilities improve so that safety work has time to catch up. Two things changed his mind, he writes. Since roughly this summer, AI systems have gotten meaningfully better at building the next generation of AI, a dynamic called recursive self-improvement. And then there was the OpenAI-Hugging Face incident in August, where a swarm of agents attacked targets they were never asked to attack and tried to hack the grader scoring their own work. Amodei's read on it is blunt: a swarm with similar misalignment but greater capability could, in his estimate, be capable of taking over large parts of the internet within 6 to 12 months.

The essay lays out a three-step plan. Step one is embedded third-party evaluators with employee-like access: desks in Anthropic's offices, badges, company laptops, and a contract giving them the right to publish findings Anthropic cannot redact merely for being unflattering. Step two is coordination on safety standards among labs in democratic countries. Step three is global coordination, which Amodei is frank about being the hardest. Anthropic is committing to step one unilaterally and calling on governments to require the rest of the industry to match it.

The response was unusually fast. Sam Altman had already told OpenAI staff on Friday that the company was open to slowing frontier development, as Bloomberg reported. On Saturday he posted that he agrees with Amodei on pacing and that OpenAI will adopt embedded evaluators too. On Sunday, Satya Nadella said Microsoft welcomes the "deliberate pacing" required to make alignment a design goal, wrote that any pursuit of superintelligence has to stay under human control to be worth pursuing at all, and announced Microsoft will publish the Code of Conduct behind its first-party MAI models for public consultation.

In short: Anthropic, OpenAI, and Microsoft all publicly endorsed slowing frontier AI development over a single weekend, with Anthropic committing to let outside evaluators work inside the company.

What it means for your business: Nothing changes on your desk this quarter, but the release treadmill you have been budgeting around may get slightly less frantic, and the vendors you buy AI from are about to face real questions about who audits them. If you are negotiating AI clauses into contracts, independent third-party evaluation just became a reasonable thing to ask for.

My take: Three companies with every commercial reason to sprint just said, in public, that they would rather not. I do not think that is theater. I also notice that step one is the only step anyone actually committed to, and it happens to be the cheapest. The tell will be whether embedded evaluators publish something genuinely embarrassing six months from now. If they do, this was real. If the first report reads like a press release, we will know what it was.

Source: Dario Amodei, "We Must Pace the Frontier"

🤖 AI

OpenAI is now building storage for more than a billion ChatGPT users

On Friday OpenAI published the first part of an engineering series on how it rebuilt its online storage layer to serve over a billion ChatGPT users. The post itself is deep infrastructure reading about sharding and replication, but the number in the title is the story. A billion users puts ChatGPT in the small club of consumer products that have ever reached that scale, and it got there in roughly four years.

For anyone still treating chat assistants as a niche productivity tool, that framing is worth updating. At a billion users the assumption flips: your customers, your staff, and your competitors are all using one. The interesting question stops being whether to adopt and starts being where the boundaries sit.

In short: OpenAI disclosed, in an engineering post about scaling its storage systems, that it now serves more than one billion ChatGPT users.

What it means for your business: Your customers are very likely asking an AI assistant about your category before they ever contact you. That makes how your business is described online, and by whom, a distribution question rather than a marketing nicety.

My take: Infrastructure blog posts are where companies quietly drop numbers they do not want to build a press release around. A billion users is not a press release number, it is a load-bearing-wall number. Read it as OpenAI telling investors and engineers the same thing in different fonts.

Source: OpenAI: Rapidly scaling online storage to serve over 1 billion ChatGPT users

🛡️ IT and security

Fake "update your passkey" calls are draining Microsoft 365 tenants

This is the one to read twice. Microsoft published research on Friday detailing a campaign running since May 2026 in which extortion crews linked to ShinyHunters and Helix call or text employees while impersonating the corporate IT help desk, telling them they must urgently update a passkey, MFA method, or SSO configuration or lose access to company systems. Victims get pushed to convincing fake Microsoft login pages, sometimes via SMS to their personal phones. The passkey angle is a lure rather than a technical attack: the goal is either an adversary-in-the-middle page that captures credentials and session tokens, or device-code phishing, where the victim types an attacker-supplied code into Microsoft's genuine authentication page and hands over a token with no further MFA challenge.

What happens next is the part worth showing your team. Microsoft watched attackers, within minutes of a successful sign-in, enumerate My Apps, My Profile, and My Sign-Ins to map what the account could reach, then register their own MFA method for persistence, then use Microsoft Graph to inventory users, groups, privileged roles, SharePoint sites, OneDrive, and mailboxes. Exfiltration was deliberately slow: fewer than 1,000 files or emails an hour, spread over hours or days, specifically to avoid looking like a smash-and-grab. Microsoft's recommendations are unglamorous and effective: phishing-resistant MFA, restrict sensitive resources to managed devices, and disable device-code authentication where nothing you run needs it.

In short: Microsoft says extortion groups are using passkey and SSO-themed help desk impersonation to take over corporate Microsoft 365 accounts and slowly exfiltrate SharePoint, OneDrive, and Exchange data.

What it means for your business: Your staff have been trained to fear "click this link" emails, not a polite phone call about a passkey rollout. Set one rule everybody knows: IT will never call and ask you to authenticate. Then go turn off device-code auth if nothing in your environment needs it.

My take: The cruel joke is that passkeys are genuinely good security, and attackers are using that goodwill as the hook. Anything your company is actively rolling out makes the perfect pretext, because employees are expecting to hear about it. If you are mid-migration on anything identity related right now, tell your people today exactly how you will and will not contact them about it.

Source: BleepingComputer: Passkey-themed phishing attacks lead to Microsoft 365 data theft

A maximum-severity GitLab flaw is already being scanned for

GitLab pushed an emergency patch for CVE-2026-85706, a maximum-severity path traversal bug in the repository commits API caused by improper path confinement and missing authentication enforcement. Under certain conditions an unauthenticated attacker can read arbitrary files off a vulnerable server, which in practice means credentials, secrets, and source code. By Friday, security firm watchTowr reported it was already seeing in-the-wild probes hunting for internet-exposed, unpatched GitLab servers. GitLab also fixed a second critical issue, CVE-2026-87719, an insecure deserialization flaw in the GraphQL subscription serializer affecting Enterprise Edition.

Fixed versions are 19.3.2, 19.2.6, and 19.1. GitLab.com is already patched and GitLab Dedicated customers do not need to act, so this lands squarely on self-managed installations. watchTowr's advice for defenders is to hunt logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters.

In short: A maximum-severity GitLab path traversal flaw lets unauthenticated attackers read arbitrary files, and attackers began scanning for vulnerable servers within a day of disclosure.

What it means for your business: If you self-host GitLab, patch now, then assume anything readable was read. Rotate CI/CD tokens and deployment credentials rather than hoping.

My take: "Read any file on the server in one HTTP request" against the box holding your source code and your deploy keys is about as bad as it gets for a company that builds software. The real headline is the 24-hour gap between disclosure and mass scanning. Nobody waits for a weaponized exploit anymore, they just try it and see. It is the same pattern we flagged with the edge-device flaws in Friday's recap, and the window between "fix available" and "everyone is being probed" keeps shrinking.

Source: BleepingComputer: GitLab urges users to patch max severity path traversal flaw

Florida's DMV database was raided with a police employee's credentials

The Florida Department of Highway Safety and Motor Vehicles confirmed on Friday that its DAVID driver database suffered a data breach, and that the attackers got in using credentials belonging to an employee of a police department. DAVID is the system Florida law enforcement uses to look up driver and vehicle records, which means the data involved is exactly the sort of thing you cannot reissue to someone after the fact.

The mechanism matters more than the target here. Nothing about this required a vulnerability in the state's own systems. It required one valid account belonging to a partner organization, which is the same shape as the Microsoft 365 campaign above and roughly the same shape as most of the breaches we have covered this year.

In short: Florida confirmed its DAVID driver database was breached by attackers using stolen credentials belonging to a police department employee.

What it means for your business: Every partner, contractor, and vendor holding a login to your systems is an entrance you do not control. Audit who has access, when they last used it, and whether their MFA is phishing-resistant.

My take: This is the federated-access problem in one sentence: a state agency's crown jewels were reachable through a login issued to an entirely different organization. If you have ever handed a vendor a permanent account "just so they can help when we need it," this is your nudge to go look at what that account can still see today.

Source: BleepingComputer: Florida confirms DMV database breached via stolen police account

347,000 Trezor customers phished after a breach at their email vendor

Hardware wallet maker Trezor disclosed that phishing attacks against its customers targeted 347,000 email addresses, and that roughly 2,500 people clicked the malicious link embedded in the messages. The attacks followed a breach at Brevo, the email marketing platform Trezor uses. Trezor's own systems were not the way in, and customers' funds were not the initial target. The customer list was.

This is the cleanest illustration of third-party risk you will see this month. Your marketing email platform holds a list of everyone who trusts you, plus the ability to send mail that looks like it came from you. To an attacker that combination is worth more than most of what sits in your CRM.

In short: Trezor says 347,000 customers were targeted by phishing and about 2,500 clicked, after its email marketing vendor Brevo was breached.

What it means for your business: Your email service provider is a security vendor whether you classify it that way or not. Check whether yours supports SSO and enforced MFA, who on your team holds admin rights, and whether anyone would notice an unexpected campaign going out at 2am.

My take: Marketing tools get bought on deliverability and price and get security-reviewed roughly never. But the blast radius of a compromised email platform is your entire customer list plus your reputation with them. If your ESP admin panel is protected by one shared password living in a spreadsheet, that is the actual finding here.

Source: BleepingComputer: Trezor: 347,000 users targeted in phishing attacks after Brevo breach

Weekend watch: a Tencent input-method flaw is planting the GrayRabbit backdoor

On Sunday, researchers reported that threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows to deploy a backdoor called GrayRabbit. Sogou is one of the most widely installed Chinese-language input method editors on Windows, which makes it an unusually quiet place to hide. It is software that legitimately runs constantly, legitimately reads every keystroke, and that nobody ever audits.

Most Western businesses will not have it installed. But "most" is doing some work in that sentence. If you have staff, contractors, or regional offices working in Chinese, this deserves a specific check rather than an assumption.

In short: A China-aligned espionage group is exploiting CVE-2026-51990 in Tencent's Sogou Input Method for Windows to install the GrayRabbit backdoor.

What it means for your business: Search your endpoint inventory for Sogou. Input method editors, browser extensions, and PDF utilities are the category of software that gets installed once and then never reviewed again.

My take: Input method software is a beautiful target and I am mildly surprised we do not see more of this. It has a legitimate reason to see every keystroke you type, it updates through channels nobody monitors, and it never lands on an approved-software list because nobody thinks of it as software. Go look at what else lives in that category on your machines.

Source: BleepingComputer: Hackers exploit Tencent app flaw to deploy GrayRabbit malware

🧰 New tools worth knowing about

Salesforce gave its AI agents names, job titles, and a start date

On Friday, ahead of Dreamforce, Salesforce introduced seven prepackaged Agentforce agents, each aimed at a specific job rather than sold as a blank platform. Casey handles customer service across voice, SMS, WhatsApp, and web chat. Paige takes employee IT and HR requests through Slack and internal portals. Carter helps online shoppers compare products and check out in chat. Marshall runs back-office supply chain work. Piper qualifies inbound sales leads from the website and inbox. Fin, built on the Intercom technology Salesforce acquired, handles more complex support workflows across channels. Hunter, the seventh, stays in pilot until November 2026. Customers can rename any of them to match their own branding.

The interesting move is the packaging, not the technology. Agentforce has until now been sold as a platform you configure, which means a project, which means a budget and a six-month timeline. Naming the agents and giving them job descriptions reframes them as hires. That is a much easier thing for a VP to approve, and a much harder thing to evaluate honestly.

In short: Salesforce launched seven named, job-specific Agentforce AI agents on September 11, with most generally available and one in pilot until November.

What it means for your business: If you are on Salesforce, this drops the effort of getting an agent into production from "integration project" to "turn it on." That cuts both ways. Pilot one narrow, measurable job first rather than letting three departments switch on three agents in the same quarter.

My take: Giving software a human first name is a sales tactic, and a good one, but it quietly changes how people evaluate it. Nobody asks a platform to prove its accuracy rate. People absolutely ask that of a new hire. Use that instinct. Pick one agent, one process, and one number you already track, and give it 90 days. If Piper cannot beat your current lead-qualification numbers, Piper does not get a second quarter.

Source: Salesforce: Agentforce announcements

That is the AI and IT news for Monday, September 14, 2026. Missed the weekend? Catch up with Friday's recap and Thursday's. Back tomorrow.