AI News Briefing — OpenAI researchers now spend $600 a day on agents

MCP

• [2026-09-05] Sessions left the MCP spec on 2026-07-28, and what replaced them is a portable handle the model carries in its context window. The Mcp-Session-Id header and the initialize handshake used to bind a client to a server instance; now each endpoint has to do that alone. Anything that can plant text an agent trusts can read or forge the handle. Validate each one against the identity it was issued to, and bind tokens to an audience. (source)

  A stateless protocol is easier to run behind a load balancer, and the check it removed did not disappear — it moved into each endpoint’s own code.

  For Security Engineers: Treat Mcp-Session-Id as untrusted input rather than routing metadata: on every call, check the handle against the authenticated identity it was issued to and reject the mismatch. Audience-bound tokens do the rest, so a stolen handle only works against the server it was minted for.

AI-assisted SDLC

• [2026-09-06] Figma put an agent on security alert triage, hung off Panther as the SIEM with tool access to audit logs in AWS, Okta, GitHub and GCP. Past investigations, behavioural steering and learned table schemas feed back in as memory. InfoQ reports 70% faster resolution on complex alerts, 20% fewer on-call pages, and a separate code reviewer reaching 80% precision within a month. Agent-opened pull requests default to draft. (source)

  Alert triage is a workable first agent job because the ground truth already exists — past investigations record what a real incident looked like. Of the numbers, the 20% fewer pages is the one an on-call rota actually feels.

AI cost tracking & telemetry

• [2026-09-06] OpenAI published what its own research organisation spends on coding agents, and the curve is steep: the median researcher went from near zero in February to roughly $150 a day in June and about $600 a day by late August, priced at API rates. The 90th percentile is past $7,000 a day. Across the org that works out to 3.1 agent-workdays for every human workday — a ratio that sat below 1 as recently as May. (official, source)

  Read the ratio rather than the dollars. Agent-workdays per human workday is something any team can compute from its own traces, while $600 a day at API rates describes a lab paying itself.

• [2026-09-07] The OpenTelemetry project walked through its GenAI semantic conventions end to end: gen_ai.usage.input_tokens and gen_ai.usage.output_tokens on spans, gen_ai.client.token.usage and gen_ai.client.operation.duration as histograms, message content captured as events. The part to act on is that VS Code Copilot, OpenAI Codex and Claude Code already emit this — point them at an OTLP endpoint and per-request cost stops being whatever a vendor dashboard chooses to show. (official)

  Because the attribute names are identical across those three tools, one dashboard can put them side by side without a per-vendor adapter in between.

  For Platform / DevOps Engineers: Stand up an OTLP collector and point the coding agents your developers already run at it — the two token-usage attributes on each span give you cost per request with no vendor console in the loop. Decide about the message-content events separately, since those carry prompts.

Practice & craft

• [2026-09-06] Daniel Shimoni’s case on enterprise RAG is that permissions are not a filter you run after retrieval — they belong in context assembly, alongside the decision of what to hand the model at all. His example is deliberately ordinary: someone leaves the finance team at 9am Monday, the index syncs at 2am, and for seventeen hours they can still pull finance documents while nothing in the pipeline registers a problem. (source)

  Seventeen hours is the distance between two schedules nobody thinks of as coupled, an HR change and an index rebuild, and syncing more often only shortens it. Nothing errors either way, so this surfaces in an audit rather than an incident channel.

Research worth reading

• [2026-09-04] PatchBench argues the numbers on agentic vulnerability patching are inflated. A quarter of agent patches closely resemble the historical developer fix, and validating only with the original proof-of-concept overstates performance by about 1.83x versus checking security and semantic correctness together. The benchmark transplants vulnerabilities into new contexts and favours bugs whose fix sits outside the crash stack trace; 11 agents tested, AIxCC entrants among them. (paper)

  Validating with the original proof-of-concept is what most internal evals do too, because it is the artefact already sitting in the ticket. Anyone scoring a patching agent this quarter should ask what its numbers look like under the stricter check.

• [2026-09-04] A study of hallucination in LLM program repair ran 832 Defects4J bugs and found 72.7% of sampled repairs contained one. Only 21–55.9% of generated patches passed the developer-written tests. The dominant failure was incorrect causal localization at 45.9% — the model fixing the wrong place — with flawed repair strategy behind another 18.5%. (paper)

  Nearly half the failures were the model fixing the wrong place. That puts the useful engineering into how a bug gets localised before generation starts, not into a better patch prompt.

Watch list

• Astra on Amazon Bedrock. OpenAI’s own launch post names Bedrock alongside Azure as a launch channel, and Azure delivered on September 3. Four days on there is still no Astra model card in the Bedrock catalogue, which is what would settle it for anyone buying through an AWS contract.

  Bedrock was named in OpenAI’s own post, so a model card in the catalogue closes this and nothing short of it does.

• AWS’s bedrock-agentcore namespace: migration guide published, agent-registry live, old namespace off on September 17.

  A published guide with a live replacement leaves only one open question: how many callers nobody has inventoried yet.

• GitSpawn’s unpatched agents. Qwen Code 0.22.3 and Grok Build 1.0.13 have gone a week without a fix while Codex, Cursor, Claude Code and Goose shipped theirs. Manifold’s second Claude Code path, through the ultrareview feature, is also still open. A published version number on either of the two laggards closes this.

  A version number is all either one needs, which is why silence past a week reads less like difficulty than a choice. Manifold’s second path is the one that gets forgotten — a product already recorded as fixed rarely gets re-checked.

• OpenAI’s disclosure framework. After the wiki incident, OpenAI said its practices for reporting agent misalignment need expanding and that a framework would follow. Nothing has been published. The artefact to wait for is a written policy saying which agent behaviours get disclosed and when, not another incident statement.

  Nothing here resolves until a document exists, since a statement after the fact is precisely what a framework was meant to replace.