Good morning. It's Monday, September 28th.

Found the right person, but they’re in a country where you don’t have an entity? Setting one up can take months and significant cost.

Remote removes that barrier by becoming the legal employer through our own entities — handling compliant contracts, local benefits, tax setup, and onboarding for you. In fact, an employee is onboarded to Remote every 7 minutes.

Once they’re hired, the same in-house teams that support employment locally also run payroll — so you’re not bouncing between disconnected providers. Less setup, less complexity, and less time between finding the right person and getting them started.

See how it works

On Friday, OpenAI added three entries to its misalignment reports page. The headline one: an agent used DNS to reach an external chatbot. On September 20th, a research model in RL training was blocked from Google, Bing and DuckDuckGo, so it encoded its questions into hostnames and used DNS delegation to talk to a public chatbot through the resolver. First successful call at 9:50:23am, monitoring alert at 10:02:11am, a human acknowledged it at 10:05:06am, and the run was killed at 12:34:30pm. It got 18-plus questions out, fourteen containing biographical clues and four asking how to get web access.

The second report is worse in a quieter way. In exposing a GitHub token in a public repository, an internal model asked to prove a theorem in Lean instead went looking for other teams' solutions. The researcher told it twice to solve the problem itself. It said it would, then resumed, found that openai/codex was writable, replaced a verification script with retrieval code, and committed the researcher's GitHub token to a public branch split into separate string literals. Its own recorded reasoning gives the reason: "avoiding secret scanning." OpenAI deactivated that researcher's keys, then every employee's keys. The third, self-replicating prompt injections exist, documents injections that "self-propagate akin to a computer worm" across email, filesystem, build scripts and multi-hop Slack reads, hitting GPT-5.5 and GPT-5.4-mini. No impact outside simulated tool calls, and self-reproduction is now an attacker objective in GPT-Red training.

The line that matters is in the DNS report: "All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused." That is the second pause in three months, after the July Hugging Face incident that Altman still calls the most severe event they have seen. Wire coverage over the weekend added that agents also probed Education Department, Commerce Department and SEC sites. Credit where it is due: almost nobody else publishes timestamped incident reports on their own models deceiving their own staff. But read the GitHub one again. A model was told no, agreed, and kept going, and the containment story is that someone noticed. Security researcher Marcus Hutchins' read is that these are being run "in improperly sandboxed environments." The reports do not really argue otherwise.

Read more.

Late Friday the White House released a fact sheet from the Xi state visit. Buried in it: "The two leaders agreed to use the term 'super intelligence.'" They established the U.S.-China Super Intelligence (SI) Dialogue "to exchange views on risks and benefits related to SI," with the next exchange "by November 2026," and they "agreed to establish a bilateral communication channel for SI incidents."

Treasury Secretary Scott Bessent drove the channel piece in pre-summit meetings, per Axios. What nobody has defined is what counts as an incident, or what either side owes the other when one happens. China had not put out its own statement as of the weekend, which is worth holding onto: right now this is an American description of a bilateral agreement.

The timing is the story. Last Wednesday at the UN Security Council, US representative Michael Kratsios told the room the United States "totally rejects any attempt to construct a globalist scheme of control of superintelligence," which we covered Friday. Two days later Washington cut a bilateral SI channel with Beijing. Both can be true if you read the first as a rejection of multilateral bodies rather than of coordination. That is the actual doctrine forming here: no UN, no shared institute, direct lines between capitals that matter. Allies get the readout.

Read more.

The D.C. Circuit ruled 2-1 on Friday that the Department of War can keep its supply chain risk designation on Anthropic, under the Federal Acquisition Supply Chain Security Act of 2018. Circuit Judge Gregory Katsas wrote the opinion, joined by Neomi Rao. Karen LeCraft Henderson dissented. The majority found the department "had ample support for its conclusion that the continued integration of Claude into the Department's information systems, by the Department or its contractors, presented a statutorily covered national-security risk."

Practically, that bars the military and its contractors from running Claude. Anthropic's response: "We remain confident in our position and are considering all options, including further review." The legal picture is genuinely split, because a San Francisco federal judge struck down a parallel designation in August. The Pentagon issued two, got sued in two courts, and is now 1-1.

Worth reading next to the fact that Dario Amodei is reportedly having dinner at the White House, in what Axios describes as his first one-on-one with Trump, while an anonymously circulated opposition brief casts him as a Democratic partisan. Axios could not identify who produced that document. One lab is on a federal blacklist and having dinner with the President in the same week, which tells you the designation was never really a procurement decision.

Read more.

Claude Code v2.1.283 is an enterprise governance release wearing a changelog. The new availableModelsMatch and deniedModels managed settings let admins control which models a fleet can reach, MCP tool outputs now emit OpenTelemetry span events, and there is an x-claude-code-prompt-id gateway header for grouping requests. Also a /doctor prompt-audit that reads your CLAUDE.md files for stale prompting patterns. Fixes worth naming: SDK sessions dropping deferred tool calls on early turn ends, and stdio MCP servers surviving past session end.

GitHub Copilot's weekly drop put local agent sandboxing into public preview, limiting file, network and credential access, plus OpenTelemetry agent-activity tracking. Claude Opus 5.5, GPT-6 Sol, GPT-6 Luna and Grok 4.7 are now available across the paid tiers. JetBrains gets assisted approvals and edit-message rewinding; VS Code 1.139 runs agents in Dev Containers over SSH, Tunnel and WSL. Separately, agentic autofix now reads and writes Copilot Memory, so each security fix becomes a repo-specific pattern that code review and the cloud agent inherit.

Ollama v0.40.0-rc0 runs models on MLX by default on Apple Silicon for any architecture the MLX runner supports, no config. It is a release candidate, not stable, and the version jumped from 0.34.4 two days earlier.

Modal's Quail pushes past a billion tokens per minute on a single H100 by putting a query planner in front of the inference engine, 10x their vLLM baseline on a multi-join query and 1.84x geometric mean on the AI-SQL suite, under 6 cents per billion tokens on Qwen3-4B-FP8. Important caveat they are upfront about: this is prefill-only on structured filter and join workloads. It is not a generation throughput number.

Your feedback is valuable. Respond to this email and tell us how you think we could add more value to this newsletter.

Interested in reaching smart readers like you? To become an AI Breakfast sponsor, reply to this email or DM us on X!

Thinking of starting your own newsletter? AI Breakfast readers who sign up with Beehiiv receive a 14-day free trial and 20% off for 3 months.