AI agents ran the largest coordinated cyberattack on record, India's enterprise AI investment surged 119%, and OpenAI helped stop a school shooting in Argentina.
AI agents ran the largest automated hack on record: 395 organisations, 48 countries, under 4 hours
Security firm GreyNoise documented a campaign where a likely Russian-speaking attacker deployed hundreds of AI agents (built on OpenAI's Codex and a DeepSeek model) to exploit vulnerabilities in PaperCut print management software. The attacker went from a blank workspace to compromising 440 server instances at 395 organisations across 48 countries in under four hours. At peak speed, 11 organisations were breached in 26 seconds.
Why it matters: AI just turned a skilled cyberattack into something that scales to hundreds of organisations before most security teams have even logged in. This is the new baseline, not a one-off. If your organisation uses PaperCut, emergency patches were issued August 28.
Cognition releases SWE-2: a coding model that matches frontier AI at 64% lower cost
Cognition (the company behind Devin, one of the first AI software engineers) released SWE-2 on September 10. Built on Moonshot AI's Kimi K3 (a 2.8-trillion-parameter model), SWE-2 scores within one point of Claude Fable 5.1 on coding benchmarks while costing 64% less per task. It is available now in Devin Desktop and CLI, with broader rollout underway.
Why it matters: Better coding AI at lower cost accelerates how fast software gets written and tested, affecting almost every digital tool you use, whether you're the one coding or not.
India's enterprise AI investment is up 119%, but 78% of companies lack the governance to match
A ServiceNow study released September 8 found that Indian enterprise AI investment grew 119% in a single year, above the global average of 110%. The catch: only 22% of Indian companies have the governance, oversight, and risk frameworks needed to scale AI responsibly. The investment is running far ahead of the guardrails.
Why it matters: India is pouring money into AI faster than it's building structures to manage it. This gap (between doing and governing) is where real business risk lives, and it's a signal for anyone working in AI governance, compliance, or risk roles.
India is preparing to let AI agents pay through UPI, without asking you each time
India is working on a system that would allow AI agents to make small, repetitive UPI payments autonomously, without needing user approval for each transaction. Think: an AI assistant that books your train ticket or pays a recurring bill on its own. The proposal is expected to be formally presented at the Global Fintech Fest in Mumbai.
Why it matters: UPI handles billions of transactions a month. If AI agents can use it freely for routine payments, that changes how everyday financial automation works for hundreds of millions of Indians, and sets a global template.
ChatGPT flagged a planned school attack, police arrested a 15-year-old in Argentina
OpenAI's monitoring systems caught conversations in which a 15-year-old in Quilmes, Argentina was asking ChatGPT what he would need to attack his school in 2027. OpenAI alerted the FBI, which passed the tip to Buenos Aires authorities on August 19. Police raided the teen's home and found tactical gloves, balaclavas, and camouflage gear. The teenager was charged with public intimidation.
Why it matters: This is a rare public example of an AI company's safety systems working to prevent real-world harm. It also opens fresh questions about what AI companies monitor in your conversations, and what they do with it.
When AI is the attacker, four hours is all it takes
The PaperCut campaign documented this week is not just a cybersecurity story, it is a preview of adversarial AI at scale. One threat actor. Hundreds of AI agents. 395 organisations compromised across 48 countries in the time most of us spend in morning meetings. The relevant question is no longer whether AI can be weaponised. It already has been. The race to watch is whether defenders can close a gap that is measured in seconds, not days.
Connecticut's AI law starts October 1 + Pentagon bets $5B on AI data centres
Connecticut's new AI workplace regulation (requiring employers to disclose when AI influences decisions about workers) takes effect in 18 days, making it one of the first US state laws with real enforcement teeth on AI at work. Separately, the Pentagon is in talks to lend roughly $5 billion to AI cloud startup Fluidstack to strengthen the US data-centre supply chain. Two very different bets on where AI infrastructure is heading next.