US Pitches China an AI Incident Alert as StepFun Ships a 600B Model

AI & Machine Learning

Chinese lab StepFun released Step 5 Preview on 20 September, a sparse mixture-of-experts model with 600 billion total parameters and roughly 27 billion active per token across a narrow, 92-layer-deep transformer. It accepts text, image and video input, supports a one-million-token context window, and is priced at $1.00 per million input tokens and $2.70 per million output tokens, with cache hits at $0.05. StepFun’s own results are mixed: it scored 66.4 on FrontierFinance against 69.7 for Claude Opus 5, and rivals beat it on three coding benchmarks. Independent tracker Artificial Analysis rated it 44 on its Intelligence Index, well above the median of 24 for reasoning models in a similar price tier. Open weights are promised for 15 October, and self-hosting will need around 1.2TB of memory in BF16 on multi-GPU servers. Source: MarkTechPost Verified: True

SoftBank is seeking more than $11 billion in a bond sale to keep funding its OpenAI position, Bloomberg reported on 20 September. The deal is split into five tranches: $10 billion of dollar bonds across three maturities and 1 billion euros of euro notes. Part of the proceeds will fund a follow-on investment in OpenAI that is expected to close next month. SoftBank has already committed nearly $65 billion to the ChatGPT maker and carries a BB+ rating from S&P Global, the top rung of speculative grade. The raise shows how much of the AI buildout now leans on debt rather than cash on hand. Source: Investing.com (Bloomberg) Verified: True

Consumer Hardware

Engadget’s review of Apple’s AirPods 5, published 18 September, gives the earbuds 8.8 out of 10. The standard model costs $129 and a version with a wireless charging case costs $149. Both now include active noise cancellation, which Engadget says blocks 50 percent more noise than the AirPods 4, and both gain Live Translation and an IP57 water-resistance rating, up from IP54. Volume-control gestures and wireless charging are exclusive to the $149 model, which the reviewer calls clearly the better buy for the extra $20. The main complaint is that Apple sells two models at all when the price gap is so small. Source: Engadget Verified: True

Startup Vocci is pitching a ring as a new form factor for AI meeting notes, TechCrunch reported on 20 September. The $249 titanium ring weighs under 6 grams, starts and stops recording with a double tap, and runs up to eight hours per charge, with a charging case holding three more. It produces AI transcripts and insights and connects to other assistants through the Model Context Protocol. The reviewer found it poor for quick short notes and flagged a privacy problem: the recording indicator faces the wearer, so others may not know they are being recorded. No release date was given. Source: TechCrunch Verified: True

Cybersecurity

Researcher Oren Yomtov of Accomplish AI disclosed two sandbox escapes in OpenAI’s Codex coding agent on 20 September, both reported to OpenAI on 12 August. The first, called Heapjack, abused a shared memory heap in the node_repl component: untrusted code could snapshot the V8 heap, guess the validation token by testing UUID-shaped strings, and then impersonate the trusted context to run commands. The second, Overpatch, exploited the patch tool’s habit of granting write access to parent directories, letting an attacker who names /tmp in a patch write into the home directory and alter shell configuration files for persistence. OpenAI fixed both within eight days in Codex Desktop build 26.818.21641 and Codex CLI 0.149.0. The researcher’s takeaway was that the enforcement mechanism lived inside the very thing it was meant to constrain. Source: BleepingComputer Verified: True

Japanese, US, Australian and German authorities issued a joint advisory on 18 September about WaterPlum, a North Korean group that infected more than 30,000 devices in over 100 countries between December 2025 and July 2026. The hackers posed as AI, cryptocurrency and NFT companies on recruiting platforms and told job seekers to download or run malicious code during fake interviews and coding tests. Malware families including BeaverTail, InvisibleFerret and OtterCookie then harvested credentials, wallet keys and documents. More than 7,000 cryptocurrency wallets were affected, and $10.7 million in stolen crypto was moved to North Korea. The advisory ties the group to the 313 General Bureau, which handles weapons research and production. Source: BleepingComputer Verified: True

Extortion crew ShinyHunters says it broke into the leak site of the Clop ransomware gang on the night of 19 September. It claims it exploited an unauthenticated file-upload flaw in the Grav CMS that runs the site, then defaced the pages with Pokémon artwork. The group also says it holds Clop’s source code, server logs, configuration files and the private keys for Clop’s Tor onion service, which would let it host the same onion address if Clop lost control of it. It gave Clop 72 hours to make contact or face extortion on its own leak site. BleepingComputer confirmed the defacement independently but could not verify the theft claims, and the feud traces back to Clop’s Oracle E-Business Suite campaign in October 2025. Source: BleepingComputer Verified: True

Enterprise Infrastructure

Salesforce used Dreamforce on 15 September to unveil Koa, its first CRM reasoning model, built by post-training NVIDIA’s open Nemotron 3 Super. Salesforce says it trained Koa on synthetic data modelled on 27 years of CRM deployments across more than 14 industries, and that no customer data was used. Customer pilots are starting with organisations including Formula 1, Xero, UChicago Medicine and Baxter Credit Union, and general availability is expected in winter 2026 in US regions. On Salesforce’s own CRM benchmark, the company claims Koa matches or beats leading models on CRM actions with three times fewer errors. NVIDIA is also supplying the foundation for a Missionforce offering that lets government and regulated customers run specialised models in air-gapped environments. Source: Salesforce Verified: True

Huawei’s next-generation Ascend 960DT accelerator will arrive in the first quarter of 2027, three quarters ahead of the original plan, The Register reported on 17 September. It carries up to 288GB of Huawei’s custom HiZQ memory and delivers up to 4 petaFLOPS at FP4 and 2 petaFLOPS at FP8, double the performance and memory of the 950 series. Its memory and bandwidth are comparable to Nvidia’s B300 family, but it offers half the FP8 compute and a third of the FP4 compute, while Nvidia’s Rubin chips reach 35 to 50 petaFLOPS at FP4. Because neither Rubin nor AMD’s MI455X can be sold in China, the 960DT becomes the most viable domestic option for Chinese AI developers. Huawei’s real edge is scale-out design: near-packaged optics let clusters reach 16 exaFLOPS across 4,096 chips. Source: The Register Verified: True

Policy & Regulation

Treasury Secretary Scott Bessent said on 20 September that the US has proposed a bilateral notification mechanism for AI incidents that could threaten national security, after roughly eight hours of talks in New York with Chinese Vice Premier He Lifeng. Bessent framed it as moving the world’s two leading AI powers from opaque to transparent on shared risks. US Trade Representative Jamieson Greer confirmed that chip and semiconductor export controls are excluded from the proposal. Chinese negotiator Li Chenggang described the discussions as constructive. The talks set the stage for a Trump-Xi meeting in Washington later this week, and one analyst said the mechanism could set a precedent other countries follow. Source: Al Jazeera Verified: True

Sony Music and Universal Music Group filed a second copyright lawsuit against AI music service Suno on 18 September, this time targeting its v6 model. The 45-page complaint covers 60,202 sound recordings and argues that v6, though built with licences from Warner Music Group, BMG and Believe, was trained on the outputs of, and preference signals from, earlier Suno models that were built by copying the labels’ recordings without permission. Suno says v6 was developed in partnership with those licensors using licensed content and community interactions. The labels seek statutory damages, which at the legal maximum could theoretically approach $9 billion, plus additional penalties for circumventing YouTube’s anti-download protections. The case tests whether a licensed model can be tainted by the unlicensed models that came before it. Source: Engadget Verified: True