Issue 37

11 September 2026

Hi there,

Meta introduced a personal agent that runs in its own virtual machine. OpenAI released a managed API for agent sessions. Both want to decide where the agent runs and how much of the plumbing the developer gets to see. There is good hardware news, too: Commerce signed a quantum-foundry research award for GlobalFoundries.

Two things from the reading list are worth opening for their own sake: a globe full of live-looking feeds and a strikingly tall monitor. Neither is a new launch this week. They are here because Julian shared them with Ethan, and the links repay a closer look.

Industry

1. Up to $375 million for a domestic quantum foundry

On 8 September, the US Department of Commerce signed a final CHIPS R&D award of up to $375 million with GlobalFoundries. The work is meant to support a domestic quantum foundry, cryogenic CMOS design kits, advanced packaging and integration. A signed funding award is not an operating quantum factory; the distinction is worth keeping as the money and the headlines grow.

Artificial Intelligence

2. Meta puts Muse in its own VM

Meta introduced Muse on 8 September. It says the personal agent and its user’s data run in a dedicated “Muse Secure VM.” A VM is a clearer boundary than an invisible process sharing a user session, but Meta’s claims about that boundary are its own. The questions for users are which data enters the VM and which tools can leave it.

3. OpenAI starts selling managed agent sessions

The Agents API entered public beta on 10 September. OpenAI says it handles session orchestration, compaction and recovery for a managed Codex harness, with durable sessions and connections to tools and MCP servers. Developers can choose OpenAI-hosted sandboxes or connect their own. That moves operational work to OpenAI; it does not decide the application’s approval rules.

4. Four California AI bills get OpenAI’s backing

In a 9 September policy statement, OpenAI backed SB 813, AB 1405, SB 1119 and AB 1864, covering independent assessments, auditors, young people and biological-risk safeguards. It also called for mandatory national requirements. This is a company’s lobbying position, not law enacted this week.

5. Two image models and better cache diagnostics

OpenAI’s 8 September API notes list two GPT Image 2.5 variants and make Prompt Cache Diagnostics generally available for supported Responses API models. The diagnostics can show why cache reuse missed; for a team paying to send a large context repeatedly, that is more useful than a generic promise of faster inference.

6. Live voice leaves preview

On 10 September, OpenAI made GPT-Live 1 generally available in the API for full-duplex voice sessions. Its published rate is $0.05 per minute for the session, with backend model and tool usage billed separately. A voice demo that quotes only the first number will understate the cost of anything it asks an agent to do.

Development

7. Enterprise policy can overrule an agent’s saved approval

GitHub introduced enterprise-managed permissions for Copilot agent operations on 9 September. Administrators can block, require approval for, or allow shell commands, file access and network domains centrally. A user’s earlier approval cannot weaken those restrictions. The controls are generally available in the Copilot app, CLI and VS Code sessions using Agent Host; they do not replace reviewing what the agent actually changed.

8. A secret can stop a pull request at merge time

GitHub’s new repository ruleset condition waits for a scan of the head commit and blocks merging while new secret-scanning alerts remain open. It adds a gate after a push, not an alternative to push protection. This is a public preview for customers with Secret Protection or Advanced Security, and bypass permissions still matter.

9. Copilot can take a batch of code-quality findings

GitHub added bulk agentic autofix for up to 25 standard Code Quality findings selected on a page. Copilot works on a branch and opens a pull request for review; assigning work consumes AI credits. The feature follows the enterprise’s existing Code Quality policy and is available on eligible Team and Enterprise Cloud repositories, not every repository by default.

Information Security

10. Anthropic reports abuse it saw on Claude

Anthropic’s September threat-intelligence report describes cyber operations, scams and influence activity it investigated through August. The cases come from its own telemetry and account investigations. They are useful examples of what Anthropic observed, not a census of AI-enabled attacks everywhere.

11. Four exploited flaws enter CISA’s catalog

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on 8 September, affecting Adobe Commerce/Magento, Windows and N-able N-central. KEV inclusion means CISA has evidence of exploitation, not just a high severity score. Check the individual CVEs and affected versions against your estate.

12. Post-quantum DNSSEC meets a 2,420-byte signature

Cloudflare’s 1.1.1.1 resolver now validates ML-DSA-44 DNSSEC signatures. A signature alone is 2,420 bytes, large enough to force DNS transports past many old assumptions about packet size. Cloudflare is testing it at Internet scale; it is not saying every domain already signs with post-quantum keys. The work now is finding resolvers and networks that quietly mishandle the larger answers.

Cloudflare added automatic remediation policies to its cloud-app security broker. Teams can set an event-driven rule to revoke an overshared file or dispatch a webhook after a finding, instead of leaving every alert in a queue. Microsoft 365 or Google Workspace integrations need read-write permission for remediation; that is an access decision to review, not a checkbox to tick automatically. Custom finding rules were still forthcoming in the announcement.

Coming up

28–29 October: GitHub Universe in San Francisco and online. The programme includes product announcements and developer sessions; launches remain to be seen.

Cheers,
Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.