Morning Skim

AI

OpenAI says Astra is its first model to cross the 'Critical' cyber threshold

OpenAI published a safety writeup for Astra, an unreleased model it says is the first to meet the highest cybersecurity level in its Preparedness Framework. Astra scored a perfect result on ExploitBench and, in a modified internal version, found and exploited two previously unknown flaws without human guidance.

Why it matters: A leading lab is conceding its own model can discover and weaponize zero-days on its own, so how tightly that capability is gated now matters more than the benchmark score.

Dive deeper → TechCrunch

Anthropic splits its newest model in two, one open and one vetted-access only

Anthropic released Claude Fable 5.1 and Claude Mythos 5.1, the same underlying model shipped with different safeguards. Fable 5.1 is generally available and costs about 25% less for typical workloads after a 75% cut to cache-read pricing, while Mythos 5.1 goes only to vetted organizations through cybersecurity and life-sciences verification programs.

Why it matters: Gating the looser version behind vetted access is the industry testing whether it can sell dangerous capability to some customers while withholding it from everyone else.

Dive deeper → Anthropic

Tech

FBI probes dark web market selling 153M driver's license scans

A dark web service called Nexus began selling more than 153 million U.S. and Canadian driver's license scans, plus 10 million ID cards, apparently stolen from identity-verification firm IDScan.net, whose clients include Target, Hertz, and FedEx. The FBI's New Orleans field office opened an investigation, and the market shut down hours after Krebs on Security exposed it, but not before listing licenses of officials including Defense Secretary Pete Hegseth.

Why it matters: The stolen images include the infrared and ultraviolet scans banks and agencies use to spot fakes, so this trove can defeat the very identity checks built to stop fraud.

Dive deeper → Krebs on Security

BGP hijack poisoned Virtualizor updates with root backdoors

Attackers hijacked BGP routes for Softaculous's update servers for roughly 33 hours in late August, serving trojanized Virtualizor virtualization updates signed with valid Let's Encrypt certificates. Hosting provider AlbaHost found root-level backdoors, via systemd persistence and rogue SSH access, on 5 of its 34 hypervisor nodes, and the vendor confirmed the incident.

Why it matters: Rerouting the internet itself to poison a software update channel, complete with legitimate TLS certificates, shows supply-chain attacks can bypass every check users are told to rely on.

Dive deeper → The Hacker News

Business

Uber axes 10% of staff to get 'simpler and faster'

Uber is cutting about 10% of its corporate workforce, roughly 3,400 jobs, stripping out management layers and concentrating teams in New York and San Francisco, with remote work limited to about 1% of employees. CEO Dara Khosrowshahi said the company must make "deliberate choices about where we put our people, our time, and our capital," and Wedbush pegs the savings near $1.7 billion.

Why it matters: A profitable tech giant shedding thousands of jobs to fund autonomous driving and driver investments signals the flattening playbook has jumped from struggling firms to healthy ones.

Dive deeper → CBS News

Broadcom's AI chip sales triple, but a $34.8B guide isn't enough

Broadcom posted fiscal Q3 revenue of $29.6 billion, up 86%, with AI semiconductor revenue surging 221% to $16.7 billion on demand for custom accelerators built for the likes of Google, Meta and OpenAI. Its roughly $34.8 billion Q4 forecast, up 93%, still landed a hair under Wall Street's bar and shares slipped after hours.

Why it matters: When tripling AI revenue and 93% growth guidance disappoints investors, it shows how stretched expectations for the AI chip trade have become.

Dive deeper → Broadcom

Science

Hubble spots a giant 10-sided pattern forming at Saturn's south pole

A team led by Agustin Sanchez-Lavega used Hubble's OPAL program to identify a decagon-shaped jet stream wave around Saturn's south pole, the first large regular pattern seen in the planet's southern hemisphere. It first showed faintly in 2023 data and is still strengthening, and the work appeared in Science Advances.

Why it matters: Saturn's famous northern hexagon has been locked in place for decades, so a sibling pattern still taking shape lets scientists watch one form in real time.

Dive deeper → ScienceDaily

Carnegie Mellon overturns a century-old assumption about the Hall effect

Physicists layered a few atomic sheets of tantalum iridium telluride with a magnetic chromium germanium telluride layer and measured a Hall response when the magnetic field ran parallel to the surface, not just perpendicular to it. The in-plane anomalous Hall effect was published in Nature Materials on September 3.

Why it matters: One ultrathin device could sense magnetic fields along several axes at once, replacing the separate sensors that electronics, vehicles, and medical imaging now need.

Dive deeper → ScienceDaily

World

US and Iran trade heaviest strikes in a month around the Strait of Hormuz

US Central Command hit dozens of military sites along Iran's southern coast, including Bandar Abbas and Qeshm Island, and Iran says a wedding party in Kuhestak was bombed, part of at least 18 deaths. Iran retaliated with missile and drone attacks on US bases in Bahrain, Jordan, Kuwait and Iraq, where Jordan intercepted 10 of 13 ballistic missiles.

Why it matters: The exchange shatters a month of relative calm in the six-month war and keeps the Strait of Hormuz, a chokepoint for a fifth of the world's oil, under blockade with diplomacy at an impasse.

Dive deeper → Al Jazeera

Germany blames Russia for explosive drone at Leipzig airport, expels consulate

Berlin formally accused Russia of the August 4 attempted attack at Leipzig-Halle airport, saying police work and intelligence "prove a Russian responsibility," and ordered Russia's Bonn consulate closed by September 18 along with the Russian House in Berlin and tighter entry controls for Russian citizens. Moscow called the accusation absurd.

Why it matters: A NATO member directly attributing an explosive drone attack on its soil to the Russian state, with EU sanctions to follow, marks a sharp escalation in Europe's hybrid-war standoff with Moscow.

Dive deeper → Al Jazeera

Culture

Noel Gallagher all but confirms Oasis summer 2027 tour

In a talkSPORT interview, Noel Gallagher teased that Oasis will play live dates next year, saying "there's no football tournament on next year, so we've got to do something in the summer." The band's promoter has secured an events permit for summer 2027, with a Knebworth return rumored and a reunion documentary due September 11.

Why it matters: The 2025 reunion was the biggest live-music story in years, and this is the first real signal it extends into 2027 rather than ending as a one-off.

Dive deeper → Consequence

Stella Lefty hit with a third song-copying accusation

Folk-pop hitmaker Stella Lefty, daughter of Groupon's billionaire co-founder, now faces a third similarity accusation on her debut album Long Way Home, with her No. 2 hit "Boston" compared to Noah Kahan's "Stick Season" and other tracks to The Chicks and Blake Shelton songs. Songwriting credits were quietly added after the fact, which Atlantic Records blamed on a "streaming platform error."

Why it matters: A chart-topping newcomer racking up three interpolation controversies on one album puts fresh pressure on how labels credit songwriters in the streaming era.

Dive deeper → Stereogum

Five minutes to everything worth knowing today.

AI