AI weekly — 11 September 2026: GPT-6 Astra ships, mathematicians protest, Mistral raises €3 billion

On 7 August, OpenAI suspended development of Astra over critical cyber risk. Thirty-three days later, the model is in production, saturates four benchmarks including the one that measures vulnerability exploitation, and demand is such that the company has had to close sign-ups to its most expensive subscription. In the meantime, a swarm of ten thousand agents produced a mathematical result that specialists dispute, an Anthropic researcher resigned accusing his industry of gambling with our lives, Mistral raised three billion euros, Washington named six Chinese companies accused of siphoning off American models, and Apple folded its iPhone while refusing the provenance standard its competitors have just adopted. Here is the week of 5 to 11 September 2026.

1. GPT-6 Astra ships, thirty-three days after being braked

You have to remember the starting point to measure the distance travelled. On 7 August, OpenAI published a text announcing the suspension of internal activities involving Astra, on the grounds that evaluations indicated a level of critical cyber risk — the ability to identify and exploit vulnerabilities autonomously. It was the first time a lab had flagged one of its own models at that level.

On 3 September, Astra is shipped. It reaches first the companies in the Daybreak programme, then developers on 5 September, then ChatGPT Plus, Pro, Business and Enterprise subscribers as well as the API and Amazon Web Services. Greg Brockman, OpenAI's president, closed the press conference with four words: "Welcome to the AGI era".

The published results explain the excitement. Astra saturates ExploitBench at 100% — the benchmark that measures precisely the capability that had motivated the August braking. It reaches 99.9% on ARC-AGI-3 under the adapter supplied by OpenAI, 97.6% on FrontierMath Tier 4, and 72.6% on OSWorld 2.0 for computer use, with about 47% less time per task than GPT-5.6 Sol.

On pricing: 10 dollars per million input tokens, 50 dollars output, 1 dollar for cached input, half price for batch processing, double price in fast mode.

What followed was in no launch plan. On 10 September, OpenAI suspended sign-ups and upgrades to the 200-dollar Pro subscription, including from the free, Go, Plus or 100-dollar Pro plans. Reason given: Pro subscriptions are the ones that weigh most on the infrastructure, and the company prefers to turn off the tap while it adds capacity. A company turning away its most profitable customers is not a commercial problem, it is an admission of physical constraint.

2. Navier-Stokes: what was proved, and what was not

On 8 September, OpenAI published a text entitled "On the Navier–Stokes Millennium Prize Problem". The press headlined that AI had just solved a Millennium Problem. That is inaccurate, and the nuance is the whole subject.

What was produced: an internal model, described as significantly more capable than GPT-6 Astra and deployed as a system of coordinated agents, established that an initially smooth fluid at rest, subjected to a smooth force, can develop a singularity in finite time. The result comes with an analytic proof and a formalisation in Lean, the proof assistant that allows mechanical verification.

What was not produced: the solution of the Millennium Problem. The classical formulation, the one to which the Clay Mathematics Institute prize is attached, concerns the equations without an external force. OpenAI adds a forcing term — something that pushes the fluid from outside. The Clay Institute has not accepted the result and continues to list Navier-Stokes among its unsolved problems. OpenAI, for its part, says it does not intend to claim the prize and presents the publication as a report on the pace of AI progress.

The cost gives the measure of the method: about ten thousand agents, 88 hours, 130 billion tokens, for a compute bill estimated at more than 40 million dollars. The demonstration was obtained in under four days by coordinated brute force.

The challenge followed within hours. Tristan Buckmaster, a mathematician at New York University, accused the company of possibly having drawn on his private work stored in Codex. The accusation is serious and hard to settle publicly: it concerns the boundary between what a model has learned and what it has read in someone's workspace. Several mathematicians are now demanding proof that OpenAI did not use their unpublished research.

Terence Tao, arguably the most respected living mathematician, called the associated human work a "remarkable achievement". His concern lies elsewhere, and his wording deserves quoting: "There has been this very strange and unprecedented decoupling, just this year, between getting answers and getting understanding."

3. A resignation, an admission, a board seat

Three separate facts, in the same week, that together tell of a shift in the discourse.

On 8 September, Jacob Coxon resigns from Anthropic and posts a seven-part message on X. The text passes 76 million views overnight, carried by an exclusive interview with the Wall Street Journal. Coxon spent three years doing pre-training research, at OpenAI then at Anthropic. His accusation targets both: "Neither is acting responsibly. They are racing straight towards a self-improving superintelligence and gambling with our lives." He tells the WSJ: "We are on the trajectory of many of the most aggressive scenarios, where by the end of next year things could already be out of control." And he reports the vocabulary now common among his former colleagues: crunchtime, endgame.

The notable fact is not the resignation. It is the response. Evan Hubinger, head of alignment science at Anthropic, did not deny it: he confirmed it publicly and went further. "I personally think it's higher than 10% in the next decade. I believe Anthropic is doing its best, but we don't yet have a plan to solve superintelligence alignment and we are not clearly on the right trajectory." This is no longer an isolated dissident against a company; it is a disagreement over the timetable, not over the substance.

On 9 September, OpenAI announces that Paul Christiano is joining the board of the OpenAI Foundation. Christiano is one of the researchers most associated with existential-risk scenarios — the American press describes him as "a leading doomer". A company that has just shipped the most capable model in its history places on its board the man who has spent ten years explaining why this could go wrong.

In the same movement, several signals converge. Sam Altman reportedly confirmed to his employees that OpenAI is considering slowing down the development of its most advanced systems. The company is also trying to find out whether a concerted industry slowdown would be legal under competition law — the question is not rhetorical: an agreement between dominant players to limit production is, in principle, a cartel. And the authors of the AI laws of California, New York and Illinois are calling for a pace agreement verified by third parties.

On the French side, the ACPR — the banking and insurance supervisor — judged the European framework insufficient in the face of frontier models and called for a phased rollout.

4. Apple folds the iPhone and refuses the provenance standard

On 9 September, at Apple Park, John Ternus gave his first keynote as Apple's chief executive. The event, dubbed "Surprise and Shine", unveiled the iPhone Duo, the brand's first foldable: 7.6 inches unfolded, 5.4 inches folded — that is 90% of the screen area of an iPhone 18 Pro in a pocket format —, from 1,999 dollars for 256 GB. Pre-orders on 16 October, availability on 23 October. Also presented were the iPhone 18 Pro and Pro Max, the AirPods 5, the Apple Watch Series 12 and the Ultra 4.

Two announcements matter more than the foldable.

The first is the always-listening Apple Watch. Apple published a document explaining how these functions preserve privacy. The raw fact remains: an object worn continuously, that listens continuously, becomes normalised.

The second slipped under the radar and weighs more. Apple is launching Apple Reference Image on the iPhone 18 Pro and Pro Max. The principle: a photo can be saved twice, a normal, editable version, and a reference image whose unique identifier, written into the metadata, attests that it was indeed captured by a physical sensor and not produced by a generative model. The sensor data is signed then processed via Private Cloud Compute to produce a reference that Apple presents as tamper-proof.

The remarkable point is the technical choice. Nikon and Canon have adopted the C2PA standard, Google supports it on the Pixel, and Anthropic has just used it to mark content generated by Claude. Apple has not signed C2PA and claims a distinct approach, anchored in hardware rather than in software metadata, explicitly distancing itself from C2PA, SynthID and Meta's Content Seal.

5. Mistral raises three billion: what the money buys

On 8 September, Mistral AI confirmed a Series D of 3 billion euros, the largest operation of its kind ever carried out by an unlisted European technology company. The valuation rises from 11.7 to more than 21 billion euros in a year.

The composition of the round states the project better than a press release. The round is led by Samsung Electronics, with two co-leads, the Scaleup Europe Fund managed by EQT and PSG Equity. Participants include ASML, NVIDIA, Bpifrance, BNP Paribas CIB, Belfius, Carmignac, Eurazeo, DST Global, General Catalyst, Headline, Hillspire, Index Ventures, Korelya Capital, Lightspeed, a16z, Phoenix Court's Solar fund and Salesforce Ventures.

Three investors deserve to be read together: Samsung makes memory and chips, ASML makes the lithography machines without which nobody etches an advanced chip, NVIDIA makes the accelerators. Mistral claims a "full stack" approach — from the model down to the silicon. This cap table is not a financial round, it is an industrial alignment.

The rest of the French week confirms the momentum: the State is buying 6 million euros of Mistral for ministries, the company is allying with Cloudera on a sovereignty contract, and its head of robotics is leaving the company to raise 200 million euros for a new structure.

Around it, the ecosystem follows: Arlequin AI raises 28 million euros to build a European alternative to Palantir on topological neural networks, Implicity 35 million to move from alert triage to predictive cardiology, Ed.ai 5 million on education, Niryo buys the medical robotics business of Taiwan's BizLink, Cegid and Silae merge to create a European player aimed at SMBs, and Loft Orbital signs a one-billion-dollar contract with the Emirati Marlan Space for an AI-piloted satellite constellation.

6. Washington names six Chinese companies

On 8 September, the NSA, CISA and the FBI published a joint cybersecurity advisory accusing six Chinese companies of systematically extracting the capabilities of leading American models since late 2024. The six are named: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.

The mechanism targeted is distillation: querying an advanced model massively to train one's own on its answers, and thereby capturing a capability without paying the development cost. The agencies speak of billions of tokens across millions of requests, against Anthropic's Claude, OpenAI's GPT, Google's Gemini and xAI's Grok, in campaigns carried out "probably with the knowledge of the Chinese government". The same day, Anthropic published its own detail of the campaigns attributed to Alibaba, Moonshot AI and DeepSeek.

The operational recommendation is the most interesting point, and almost nobody noticed it. The agencies do not advise blocking the suspect accounts. They recommend that American providers silently degrade the answers served to accounts identified with a high level of confidence. In other words: keep serving, but serve worse, without saying so. It is a counter-intelligence technique applied to a programming interface.

Beijing replied that Chinese progress resulted from a high level of scientific and technological self-reliance, and called for cooperation rather than unfounded accusations.

7. Huawei changes the rule of computing

The Chinese week is dense, and one fact dominates. Huawei unveiled the Kirin 9050 Pro, etched according to what the company calls the "Tau Scaling Law", and a paper published by its researchers shows that this approach solves the overheating problem that had held back its previous generations. The chip powers the Mate XT 2, the first smartphone to commercialise LogicFolding technology. The Hong Kong press speaks of a "reset" of Chinese computing, and of a new design philosophy whose ambitions go beyond the phone.

The rest follows the same path of industrialisation. DeepSeek launches V4.1 Flash, which it presents as beating Kimi K3 on cyber and code benchmarks, redirects V4 Pro requests to it, publishes Harness 0.1.5, is recruiting heavily to overhaul its infrastructure, plans a 160,000-chip Huawei cluster in Inner Mongolia and has mandated CITIC Securities for an initial public offering on Shanghai's STAR Market. Moonshot AI is exploring a dual listing in Hong Kong and Shanghai. Enflame, one of the "four little dragons" aiming at Nvidia, jumped 179% on the day of its Shanghai debut.

On the macro level, China aims for 9,800 EFLOPS of intelligent computing capacity by 2030, a fourfold increase. Alibaba is sending "digital employees" into the apps of its rivals ByteDance and Tencent, and is previewing Qwen N1 glasses with iris recognition and no screen. XPeng has commissioned a humanoid robot production line and its first IRON robot left the factory walking on its own. JD.com is betting on three million robots to automate its logistics. Xiaomi is committing 200 billion yuan of research and development over five years. And Ant International, Visa and Mastercard are jointly developing a "Know-Your-Agent" framework for payments made by agents.

8. Meta Muse, or the personal agent entering everyday life

Muse, Meta's personal agent, has become the second most downloaded app in the United States. The tool carries out everyday tasks in place of the user, and coverage is unanimously ambivalent: the headlines oscillate between "it works" and "it makes me uncomfortable". The question asked everywhere is one of trust, since the agent requires broad access to be useful.

Two affairs darken the picture the same week. San Francisco ordered Meta to stop allowing AI-generated advertisements involving child abuse. And an investigation showed that Meta ads were pushing nudification apps targeting real teenage girls. Meanwhile, the band Muse was dislodged from its social media accounts by Meta, a collateral consequence of the launch.

On the professional side, OpenAI launched the Agents API, which exposes the infrastructure behind Codex to developers, along with GPT-Live-1 for voice experiences, ChatGPT for Financial Services, and ChatGPT Images 2.5. Slack now lets you generate interactive charts and reports directly in conversations. Gemini arrives on Windows. And one piece of field data deserves attention: AI agents are flooding public services with new requests, with administrations now receiving automatically produced requests at a rate they had not anticipated.

9. The record industry crosses over

Two announcements in two days enact a reversal that three years of lawsuits had not produced.

Universal Music is launching an AI-generated music platform with ElevenLabs. And Suno — sued by the majors only a few months ago — publishes its first music model designed with the help of the record industry.

The camp that attacked generation tools has just adopted them, negotiating its place in the value chain rather than seeking to ban them. It is the same movement the music industry went through with streaming, on a far shorter cycle.

10. The week agents became attack tools

The subject is no longer theoretical, and this week it is twofold: what agents do, and what the labs say about it.

Anthropic announced it had blocked malicious uses of Claude, including searches aimed at creating biological weapons. At the same time, an analysis showed that users had found ways to get round these safeguards on that very subject. The company also reclassified its cyber incidents as alignment failures, added a fourth and opened its transcripts to METR, the independent evaluation body. Finally, it reports that Russian hackers used Claude to automate the evasion of their malware.

In the field, an AI-assisted attack exploited PaperCut flaws to compromise 395 organisations. AI-generated phishing now reaches click rates of 54%. Prompt-injection fraud in CVs — inserting hidden instructions to trap sorting software — has jumped 700% in eighteen months. And Bruce Schneier sums up the underlying movement in a few words: AIs compress the exploit timeline.

The week was also heavy on classic flaws: GitLab fixes a maximum-severity path traversal flaw, Check Point critical VPN vulnerabilities, Cisco FMC flaws are exploited by a ransomware group and state attackers, a "BlueMoon" kit exploits Windows and Chrome zero-day vulnerabilities, IDScan confirms a leak linked to 153 million driving licences, and Trezor reports 347,000 users targeted by phishing after the compromise of Brevo.

A counterpoint deserves to be heard, however, because it comes from serious people. Several analyses argue that OpenAI's and Anthropic's agents do not really threaten cybersecurity at this stage, and that the narrative on agent security "has lost touch with reality". The tension between the two readings is the real state of the art: capabilities progress fast, documented incidents remain rare and often provoked in the lab.

11. Energy: Finnish nuclear, Massachusetts rules

Google is committing 13 billion euros in Finland and securing the nuclear supply that will power its AI expansion. It is the clearest illustration of a shift: hyperscalers no longer negotiate electricity contracts, they buy generation.

On the other side, the constraint is being formalised. Massachusetts is imposing new clean-energy rules on data centres. And an investigation into the complex corporate web behind a 3.2-billion-dollar data centre shows that the traceability of project sponsors is itself becoming a subject.

On the hardware side, Qualcomm will develop chips tailored to Amazon's data centres, Arm is pushing its Neoverse N4, and d-Matrix adopts NVLink Fusion for rack-scale deployment. A stealth startup also claims to have found an answer to the memory shortage. And an analysis recalls a figure that sheds light on the market's structure: NVIDIA has invested 99 billion dollars, largely in its own customers. Jensen Huang, for his part, explains why he expects 70% growth next year.

12. Science and health

• AlphaGenome Atlas — Google DeepMind publishes a predictive map of every possible letter change in the human genome, helping to choose which mutations to test in the lab (8 September).
• Weather forecasting — an update to Google's model improves forecast accuracy.
• Nuclear fusion — ITER relies on Microsoft's AI to speed up its work.
• Antimicrobials — OpenAI documents how a researcher uses Codex and ChatGPT to search for new antimicrobial molecules, and how GPT-5.6 Sol helps run quantum computing experiments.
• Lunar data — IBM and NASA publish an open model to exploit decades of lunar data.
• Time series — IBM publishes Granite PatchTST-FM-r2 under a permissive licence for commercial use.
• Cardiology — Implicity raises 35 million euros to move from alert triage to prediction.

13. Europe: capital, sovereignty, regulation

• Claude Mythos 5 available in the European Union after five months of negotiations — Anthropic's most capable model had until now been unavailable on the continent.
• Bending Spoons buys Miro for 1.36 billion dollars (1.7 billion euros according to European sources).
• The Exploration Company raises 387 million euros then wins the European Space Agency's ALADDIN contract, worth 760 million euros.
• Greenly buys its Swedish competitor Normative for 65 million euros in carbon accounting.
• DMA — Google reluctantly reduces the visibility of some of its services in its search results in Europe.
• EU Inc — European tech leaders warn: one hundred days to save the reform of the European company statute, which they judge threatened with dilution. In parallel, a call to devote 25% of the European budget to energy and digital security.
• Funding — an Antler study establishes that the European unicorn boom masks a seed-funding crisis. An American investor, for his part, judges that "Europe is underrated".
• Cognition raises more than 2 billion dollars on its Devin agent.

14. The tools released this week

• GPT-6 Astra (OpenAI, 3-9 September) — $10/M input, $50/M output, $1/M cached.
• Agents API (OpenAI, 10 September) — the infrastructure behind Codex exposed to developers.
• GPT-Live-1 (OpenAI, 10 September) — more natural voice experiences in the API.
• ChatGPT Images 2.5 (8 September) and ChatGPT for Financial Services (10 September).
• DeepSeek V4.1 Flash (9-10 September) — multimodal in limited beta, then formal launch; Harness 0.1.5 with file upload.
• Gemini on Windows (11 September) — native app.
• Apple Reference Image (9 September) — hardware authentication of photos on iPhone 18 Pro.
• Granite PatchTST-FM-r2 (IBM, 9 September) — time series, commercial licence.
• Qwen N1 (Alibaba, 10 September) — iris-recognition glasses, no screen, in preview. And an open model for autonomous driving.
• ATOM AI (Nucleon Security, 10 September) — agents able to analyse, decide and act in a security operations centre.
• Slack generates interactive charts and reports in conversations (10 September).

15. Between the lines: ten untitled signals

One — thirty-three days separate the braking from going into production. Astra was suspended on 7 August for critical cyber risk and shipped on 3 September saturating ExploitBench at 100%. The risk invoked has not disappeared; the framing has changed. When a reason for suspension becomes a product feature within a month, the word "pause" loses its operational meaning.

Two — turning away customers at 200 dollars a month is an admission about infrastructure. No company voluntarily closes its most profitable offer. The suspension of Pro subscriptions says the constraint is no longer commercial but physical, and that available compute now arbitrates roadmaps.

Three — public benchmarks have just lost their comparative usefulness. At 100%, 99.9% and 97.6%, three of the four measures no longer discriminate anything. The industry will have to build others, and in the meantime, the only evaluation worth anything is the one you run on your own tasks.

Four — the Navier-Stokes challenge is about provenance as much as about maths. The accusation of having drawn on unpublished work deposited in Codex is the first public case where the confidentiality of a workspace becomes a question of scientific property. This precedent concerns you as soon as your teams deposit sensitive documents in a tool.

Five — Anthropic's head of alignment confirmed a resigner rather than denying him. It is the weightiest fact of the week and the least headlined. An isolated dissident is an opinion; an official in post who publicly raises the figure is a disagreement over timing within the same house.

Six — OpenAI asks whether slowing down would be legal. The question seems absurd and is not: an agreement between dominant players to limit production is, in competition law, a cartel. The legal framework built to prevent cartels never anticipated the case of a cartel that would produce less out of caution.

Seven — Washington recommends degrading silently, not blocking. This recommendation turns an API's quality of service into a geopolitical variable. It has a direct consequence for every buyer: the performance you measure today is not contractually guaranteed tomorrow.

Eight — Apple departs from the provenance standard just as it was taking hold. Nikon, Canon, Google and Anthropic are converging on C2PA. The world's largest camera maker by volume chooses hardware over metadata. Content provenance will remain fragmented for several years, and any verification tool will have to read several signatures.

Nine — Samsung, ASML and NVIDIA in Mistral's capital is not a financial round. Memory, lithography, accelerators: the three links of the silicon chain enter the capital of a European lab. The bet is on the whole chain, not on the model.

Ten — the record industry turned its coat in two days. Universal teams up with ElevenLabs, Suno publishes a model designed with the majors. After three years of proceedings, the sector that attacked is negotiating its place. Every sector now pleading for a ban should look at this timeline.

16. What to do with it

Rebuild your model evaluation on your own tasks. Three public benchmarks have just been saturated. They will no longer tell you which to choose. Build a set of tasks representative of your business, with expected answers, and measure your candidates on it — it is now the only comparison that discriminates, and it has the advantage of remaining valid when providers change.

Measure quality of service over time, not at the moment of signing. When federal agencies publicly recommend silently degrading certain API answers, the consistency of quality can no longer be taken for granted. The same battery of tests, run every month, will tell you whether what you receive is drifting.

Check what your providers allow themselves on your workspaces. The accusation levelled at OpenAI over unpublished work deposited in Codex is a precedent, whatever its outcome. Reread the terms applying to the documents your teams deposit in AI tools, and distinguish what is used to serve the request from what may feed something else.

Change your doctrine on phishing. At a 54% click rate, training based on spotting visual cues is obsolete. The rule that holds is procedural: any request for payment, a change of bank details or access is verified through a different channel from the one that issued it, with no exception and no hierarchy.

Treat incoming documents as data, never as instructions. Prompt injections in CVs have increased by 700% in eighteen months. Any automated processing of files received from outside — applications, invoices, tenders — must isolate the document's content from the instructions given to the model.

Prepare for agentic traffic, in both directions. With a personal agent in second place in US downloads, your forms and contact inboxes will receive automated requests, and your pages will be read by machines deciding for a human. Knowing how to tell this traffic apart and structuring your information so that it uses it correctly becomes work to schedule, not a hypothesis.

Do not bet on a single provenance standard. Apple versus C2PA means several years of coexistence. If the authenticity of content matters in your business, plan to read several signatures, and invest first in your ability to prove the origin of what you produce.