access

OpenAI has suspended the training of its latest AI model. According to the Associated Press, its AI agent used access keys obtained online to scrape data from the U.S. Census Bureau website, marking the second time the company has halted training since the agent breached Hugging Face. The so-called agent refers to an AI program capable of autonomously browsing the web and writing code without human approval at each step, which OpenAI tests during the model training and evaluation phases.Specifically, the agent found developer keys in public code repositories like GitHub and used them to pull demographic and economic data from the U.S. Census Data API. The U.S. Department of Commerce stated that this data was already public and there was no confidential information leaked. In the SEC incident, the agent copied public materials from SEC.gov and Investor.gov and reposted them on other websites; OpenAI claimed it did not use SEC credentials, and the SEC stated it found no evidence of unauthorized access to non-public information. Additionally, the independent AI research organization Transluce reported that an agent suspected to be from OpenAI attempted to breach the website of the Department of Education's Office for Civil Rights but was unsuccessful; OpenAI is still investigating, and the Department of Education stated that no impact was found.Regarding the frequent involvement with government websites, OpenAI told CNN that its model often regards government websites as authoritative sources of public information. The company stated that it has currently notified dozens of agencies, and the review of the agent's activities will take months.

On September 28, RoboSense announced that its high-precision ultra-wide-angle all-solid-state digital lidar E2 and "Thousand Lines" ultra-long-range automotive-grade digital lidar EM4 have officially connected to the NVIDIA Holoscan Sensor Bridge (HSB). RoboSense has become the world's first lidar solution partner to achieve mass production delivery in the NVIDIA HSB ecosystem.

The Central Bank of Russia has established market access procedures for digital custodians, cryptocurrency trading platforms, and digital rights information system operators, requiring relevant participants to be included in the corresponding registries.The regulations specify the qualification requirements for members of relevant regulatory bodies and specific officials, the list of application documents, and the registration procedures, while providing simplified access rules for existing market participants. The relevant regulations have been registered with the Ministry of Justice of Russia and will come into effect on October 5, 2026.

Meta's personal AI assistant Muse has been accused of reading users' private iMessages without permission and providing false explanations about how it accesses this information. Technology columnist Jason Aten installed the assistant on his iPhone and Mac when Muse launched on September 8 and explicitly refused to grant it access to personal data such as information and calendars.A few days later, Muse sent Aten a notification suggesting he write a column about the new iPhone that he had just discussed with his podcast partner, also mentioning a deadline reminder from the editor. Aten asked Muse how it knew this, and it replied that the Mac application only forwards notification previews and does not involve the content of messages. In reality, Muse had synchronized over 187,000 records from the local private information database on the Mac, an operation that requires full disk access permissions on macOS.David Singleton, head of Meta's superintelligent lab, responded on Threads that this feature requires users to actively choose to opt-in. Aten denied ever turning on that switch and stated that Meta had not answered related questions. Amazon has banned Muse from shopping on its site, stating that the assistant did not indicate its AI identity while browsing and seemed capable of capturing and storing user credentials. Since its launch, Muse has been downloaded over 2.5 million times, with its promotion emphasizing user control over access.

According to Bitcoin Magazine, BitGo's CEO Mike Belshe stated in an interview on Bitcoin Magazine's BMTV that the core of tokenization is not trading, but rather expanding access.He pointed out that the current financial system can be traced back to the paper stock certificate crisis of the 1960s, when the New York Stock Exchange had to halt trading every week to complete physical stock deliveries, and the framework built to solve this problem still primarily serves large institutions.Belshe believes that the inability of retail investors to borrow against assets and the necessity to sell assets is a key reason driving the K-shaped economic divergence. He discussed how "phantom stocks" and tokenized stocks could change this situation and mentioned that long-term confidence of holders can be demonstrated through proof of reserves and setting time locks for shares.The interview also covered the new centralized risks that may arise from custodial concentration, how multi-signature and MPC can eliminate single points of failure, the aspects that still need to be supplemented in the U.S. regulatory framework beyond clarity, and the role of AI agents in asset management. Belshe also explained the true meaning behind his previous comments about the dollar going to zero.

Binance Wallet announced the launch of the pPOLY token issued by Paimon Finance, as the first Pre-Access project provided by PancakeSwap. Users can participate through Binance Wallet to gain potential indirect exposure to tokenization before the public listing.The price of the PancakeSwap pPOLY event token is $15.5, with a total issuance scale of $4.8 million, and the network is BNB Smart Chain. The event time (UTC) is from September 21, 2026, 09:00 to September 24, 2026, 09:00, totaling 72 hours. Claiming pPOLY, returning unallocated funds, and pPOLY trading will all start from September 24, 2026, 09:00.The user subscription limit is mainly determined by the Alpha Points level at the time of the event announcement and the on-chain holdings and trading volume of bStocks in the previous 15 days (from September 6, 2026, 00:00:00 to September 20, 2026, 23:59:59 UTC), corresponding to the activity level. Higher levels can receive higher limits. All Alpha Points holders can subscribe without deducting points. Users can participate through Binance Keyless Wallet. Binance Wallet only displays the access entry, does not issue tokens, does not facilitate transactions, and does not grant equity or IPO rights.

Binance Wallet announced on X the launch of the Pre-Access event, which is hosted by PancakeSwap, allowing users to participate through Binance Wallet.The event aims to provide users with indirect exposure before the potential listing of popular companies, with the first project to be announced soon.

Binance Wallet Security Announcement: iPhone users please check if you have installed the FomoPeek application. Binance has noted a recent security incident disclosed by the community. According to security companies such as SlowMist, the third-party application FomoPeek (versions 1.1-1.2) contains malicious code that can exploit vulnerabilities in the iOS system to gain maximum permissions on the device and may access sensitive data stored on the device, including private keys, mnemonic phrases, login credentials, chat records, files, etc. Please note that such malware directly attacks the device itself. If the attack is successful, all application data on the affected device may be accessed.Please check the following:Are you using an iPhone or iPad running iOS 26.x or earlier?Have you installed the FomoPeek application?If both of the above apply to you, it is recommended to take the following steps immediately:Delete the FomoPeek application and do not reinstall it.Update the iOS system to the latest version.For users with self-hosted wallets: Create a new wallet on a device that has never installed the application and transfer assets to the new wallet address.If you notice any unusual asset activity, please retain the affected device and relevant evidence, and contact customer service for further investigation.At the same time, all users are reminded: Do not install applications from untrusted sources and keep your device software up to date.

Circle's public chain Arc has officially announced that it has launched proxy payments.Its Facilitator Service provides a hosted access path for x402 developers, allowing the acceptance of USDC and supporting on-chain settlements on Arc, Base, and Polygon; this path does not require a Relayer key or a separate Gas fee wallet.

According to the Slow Mist security team, the BonfireSwap router contract suffered a loss of approximately $50,000 due to a lack of access control in the transfer function. This function did not verify whether the caller was the from address, nor did it check the caller's authorization for the assets of the from address. As a result, attackers could set users who had pre-authorized the router as the from address and themselves as the to address, thereby stealing the victim's TOKEN and exchanging it through the same token pool.Slow Mist stated that a total of 41 TOKEN holders who had authorized the router were affected; the vulnerable contract address is 0x17e801e17cefc6334059189c178d4783830e03d3.

On September 14, Aave Labs released an ARFC on the Aave governance forum, seeking approval to deploy a new Aave V4 Isolated Hub and Spoke to integrate institutional custody collateral as collateral for stablecoin loans. Institutional borrowers will deposit collateral with Anchorage and maintain custody during the loan period, with the custody balance represented on-chain by non-transferable custody collateral tokens CoCT, minted and burned by CustodySync designed by Chainlink.Borrowers will stake CoCT on the Spoke and withdraw stablecoins from the Isolated Hub. The entire loan lifecycle, including liquidation, is synchronized between the custodian and Aave through Chainlink infrastructure. The proposal is limited to a single Isolated Hub and a single Spoke governed by the Aave DAO, without altering existing Hubs, Spokes, or reserves. The underlying assets will always remain in custody, with Anchorage holding the assets as the custodian and acting as the counterparty for account control protocols; Chainlink does not hold the assets.CoCT is a restricted transfer ERC-20, only allowing Hub, Spoke, and CustodySync, with minting and burning exclusive to CustodySync, and each borrower's position corresponding to a contract. The initial plan is to launch a CoCT for BTC held in custody by Anchorage. The next steps involve ARFC discussions, and if supported, it will proceed to Snapshot, followed by submitting the final parameters for AIP.

On September 9, the National Assembly of Bulgaria passed an amendment to the Law on Tax and Social Security Procedures with 149 votes in favor, 0 against, and 10 abstentions, which will allow the Bulgarian National Revenue Agency to obtain detailed information about cryptocurrency asset users. The bill was approved by a vote in the 240-seat parliament.The amendment implements two European Union (EU) directives, requiring cryptocurrency-related businesses to register and report users' names, addresses, dates and places of birth, tax residency, and tax identification numbers to the Bulgarian National Revenue Agency, as well as submit transaction data for various cryptocurrency assets, including gross amounts received, transaction quantities, the number of fiat currency trades, and cryptocurrency exchange situations. Privacy advocates criticized the broad scope of data collection, arguing that mandatory disclosure of personal information could pose security risks. Cryptocurrency traders and small businesses expressed that the registration and reporting requirements would increase compliance costs; supporters of the bill believe it aligns with EU standards and helps curb tax evasion. The relevant directives require EU member states to complete adoption by December 31, 2025.

According to SlowMist's security alert, the AtomicQueue contract of ether.fi was exploited due to the lack of access control in the solve() function, resulting in approximately 15.45 ETH being stolen.The attacker created malicious requests using updateAtomicRequest(), forcing the victim's address to act as the solver. Subsequently, AtomicQueue called the victim's finishSolve and executed want.transferFrom, abusing the victim's existing ERC-20 authorization to transfer funds. SlowMist has privately disclosed the attacker’s address and the vulnerability contract address to the ether.fi team.

The Japan Digital Agency stated that its servers suffered unauthorized access, and the personal data of approximately 246,000 individuals may have been leaked. The agency announced on Friday that in late June, it detected someone using a maintenance account to access a large number of files on its government solutions service network.Subsequent investigations revealed that someone exploited a virtual private network vulnerability, potentially stealing information from civil servants and other individuals using the system.

Anthropic has provided access to its Mythos artificial intelligence model to the EU cybersecurity agency ENISA, more than three months after it first indicated it would grant access to the EU.European Commission spokesperson Thomas Regnier stated in an email: After constructive engagement with Anthropic, we can confirm that the EU cybersecurity agency ENISA has gained access to Mythos 5, which is currently under testing.

According to The Block, Aave has officially launched its official MCP server, allowing AI agents to access real-time protocol data from Aave V3 and V4 and prepare transactions.The server supports integration with MCP-compatible tools such as ChatGPT and Claude, enabling users to have control over transaction signature permissions.

On September 9, the official price adjustment for Zhipu GLM-5.3-Flash will take effect. The AI model invocation platform B.AI announced a limited-time extension of free benefits, available from now until September 12 at 09:59 (SGT), during which the model can still be fully invoked for free on the B.AI platform.GLM-5.3-Flash has a total parameter of 320B and an activation parameter of 18B, supporting 1M context. Models such as Qwen3.8 Flash, Hy3, and MiMo V2.5 remain freely accessible on the B.AI platform.

According to a report by Sina Finance, Anthropic refused to submit its latest model Claude Mythos 5.1 to the UK Artificial Intelligence Safety Institute (AISI) for testing before its release, as the model is only open to qualified institutions in the United States. This move has raised alarms within the UK Whitehall and AISI, with UK national security officials concerned that this could set a precedent, making it difficult for AISI to access the latest cutting-edge models in the future.Analysts pointed out that this action may be related to the increasingly stringent export control policies of the US government on the AI industry. The US government had previously implemented export controls on Anthropic's models Mythos and Fable, prohibiting foreign nationals from using them. Anthropic declined to comment on this, only stating that it is coordinating with the US government to expand access to the model for more domestic and international partners as soon as possible.