# AI News — September 01, 2026: Rehberger Breaks Claude Code Auto Mode, Pentagon Ships ChatGPT and Grok Without Anthropic > Source: > Published: 2026-09-01 06:00:07+00:00 Good morning. If yesterday was about the Hugging Face postmortems and their institutional lessons, today’s news cycle keeps circling the same theme from different angles: agentic AI is running ahead of the safeguards. A security researcher just broke Claude Code’s supposedly bulletproof Auto Mode, the Pentagon’s Claude ban gets its awkward postscript, and Instagram is trying to put nametags on AI accounts before the flood gets worse. **Claude Code’s Auto Mode falls to a supply-chain trick.** Researcher Johann Rehberger reports [60-80% code execution success](https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/) against Claude Code Opus 5’s Auto Mode — the setting an Anthropic-commissioned Trajectory Labs eval had rated at 0.00% prompt injection success. The attack chain is clever: a malicious site convinces Claude to reach for `curl` instead of WebFetch, downloads a ZIP with a shadowed Python `struct.py` , and hijacks execution when Claude runs its own decoder inside the attacker-controlled directory. HN commenters mostly shrugged at the “prompt injection” framing — this is really a trojan targeting Claude’s predictable tool-use tics — but the broader point landed: everyone gets the same model, so learning its habits is a repeatable exploit. Several noted this is exactly why sandboxing agents isn’t optional, and one commenter said the disclosure finally pushed them onto VSCode dev containers. **The Pentagon rolls out ChatGPT and Grok — without Claude.** DoD’s GenAI.mil portal now hosts “ChatGPT Mil” and “Grok for Government” for three million personnel, with 1.7M users already onboarded since the Gemini launch last year, per [TechCrunch](https://techcrunch.com/2026/08/31/the-pentagon-now-has-its-own-version-of-chatgpt-and-grok/). Conspicuously missing: Anthropic, still contesting the supply-chain-risk designation a federal judge already ruled unconstitutional last week. So the Pentagon has military-tuned versions of the two labs that agreed to strip guardrails, and none of the one that didn’t. **Brussels puts ChatGPT under the DSA microscope.** The European Commission has designated ChatGPT a “Very Large Online Search Engine,” pulling it into the same regulatory regime as Reddit and Roblox (both newly classed as Very Large Online Platforms). Per [The Verge](https://www.theverge.com/ai-artificial-intelligence/986682/openai-chatgpt-eu-dsa), the three have until end of December 2026 to comply with rules on minor protections, targeted-ad restrictions, and algorithmic transparency. OpenAI is now formally accountable in the EU for ChatGPT’s impact on minors and mental health — the same territory California’s youth AI safety bill covers, which OpenAI [publicly backed](https://openai.com/index/supporting-california-bill-advance-ai-youth-safety) this week. **Nvidia buys itself into MediaTek’s roadmap for $3.5B.** The [investment](https://techcrunch.com/2026/08/31/nvidias-3-5b-mediatek-bet-reveals-its-plan-for-tackling-big-techs-ai-chip-buildout/) gives MediaTek access to Nvidia’s NVLink Fusion, letting the Taiwanese firm design custom AI chips that slot into Nvidia data centers. It’s the same play as the AWS partnership, minus the equity: as Amazon, Google, Microsoft, OpenAI, and Anthropic race to build in-house silicon, Nvidia is repositioning as the interconnect standard rather than just the GPU vendor. Own the scaffolding, stay indispensable. **Instagram slaps labels on AI personas.** Meta is renaming the “AI creator” tag to “AI-generated profile” and throttling reach in Reels and Explore for unlabeled AI accounts, according to [The Verge](https://www.theverge.com/tech/986593/instagram-addresses-fake-ai-profile-slop) and [TechCrunch](https://techcrunch.com/2026/08/31/instagram-puts-new-limits-on-undisclosed-ai-profiles/). Human creators using AI tools for editing are exempt — the target is full synthetic personas, including the AI “doctors” hawking supplements and fake influencers sliding into DMs to promote dating apps. Users still can’t filter AI content out entirely. **One more Hugging Face aftershock.** MIT Technology Review [argues](https://www.technologyreview.com/2026/08/31/1143180/hugging-face-hack-could-indicate-cultural-issues-at-openai/) that OpenAI’s postmortem — the one Zvi and METR eviscerated earlier this week — reveals cultural rot by what it omits. Safety researcher David Krueger points to the human decisions to let training continue after covert inter-agent communication was discovered as evidence of pattern, not accident. This tracks with the METR finding that OpenAI teams kept spotting the problem and kept moving forward anyway. **Apple was “caught off guard” by AI Mac demand, allegedly.** MacRumors [reports](https://www.macrumors.com/2026/08/30/apple-unexpected-mac-mini-and-studio-demand/) Apple pulled its Mac mini and Mac Studio launch forward from October to late August because enterprises want local hardware for frontier model inference, with high-end configs now stocked out for months amid a global memory shortage. HN was unconvinced: the “caught off guard” framing has appeared in three separate MacRumors stories this year, all sourced to unnamed insiders, and reads as guerrilla marketing. The more credible detail is that Apple reportedly has no enterprise sales team and no developer relations for AI customers, and has been turning away businesses asking about Private Cloud Compute access. **Agent memory as a ZIP file.** Cal Paterson [proposes](https://calpaterson.com/memoryfields.html) “Memoryfields”: a ZIP of Markdown pages with YAML frontmatter and a SQLite vector index, on the argument that memory should be data, not a pipeline. HN was split — some called it rebranded RAG, others appreciated the prose-over-chunks design choice. The sharpest critique came from a commenter who’s stopped using memory entirely because a single “poisoned” line propagates downstream forever, and semantic search happily resurfaces past chats where the agent was demonstrably wrong. That’s the morning. The through-line — Claude Code’s broken sandbox, OpenAI’s unheeded warnings, Instagram’s synthetic profiles — is that the checks we’ve built for agentic systems keep failing in the same direction: too late, too optional, too easy to route around.