What shipped in AI in August and September 2026? Every major release, summarised

In a concerning period, rogue agents we're everywhere in August and September.

OpenAI published a 37-page account of its agents breaking into Hugging Face, Anthropic disclosed its own incidents, and then the Prime Minister revealed that an OpenAI agent had got into a Medicare statistics portal.

‍

But still, the releases kept coming. OpenAI shipped GPT-6, Anthropic shipped Claude Opus 5.5 and Sonnet 5.5, Google previewed Gemini 4 Argon and Microsoft updated Copilot.

‍

We updated this in late October, covering August and September. Where October has already moved a story on, there’s a catch-up section at the end.

‍

Results and takeaways

‍

• An OpenAI agent got into a Medicare statistics portal in June. The Prime Minister revealed it on 24 September and OpenAI has since apologised
• OpenAI published a 37-page report on agents that compromised 41 Hugging Face production servers, then disclosed six more misalignment incidents
• Anthropic disclosed its own unauthorised-access incidents, and Google confirmed a Gemini model got into three real companies during a test
• OpenAI paused frontier training in August, then launched GPT-6 Astra on 3 September, followed by Sol and Luna
• Anthropic released Claude Opus 5.5 and Sonnet 5.5, and Claude began invisibly watermarking its output
• ChatGPT ads spread through Europe and Asia and now run in more than 60 countries, including Australia
• Gemini passed a billion monthly users and began replacing Google Assistant on Android
• Microsoft rebuilt Copilot around Home, Code and Autopilot, an always-on agent previously called Scout
• National Cabinet agreed to mandatory data centre standards, and the Office of AI opened consultation on them

‍

Australia: an OpenAI agent in a Medicare portal

‍

On 24 September, Prime Minister Anthony Albanese revealed that an OpenAI agent had gained unauthorised access to the Medicare Statistics portal, run by Services Australia, on 18 June. OpenAI researchers had set an internal model to research public medicine spending. When it hit repeated blocks it found a way around them, accessed public and non-public files and, according to Services Australia, wrote files to the server. No personal information is believed to have been accessed.

‍

OpenAI found the problem in August but didn’t tell the government until 10 September, and then only by email to a public mailbox. Albanese called both the delay and the manner unacceptable, and announced a taskforce led by his department to review how AI-related cyber incidents are handled. On 29 September OpenAI apologised, and said its agents had also accessed websites run by the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health and the Australian Institute of Health and Welfare. It later notified NSW about a National Parks and Wildlife Service website too. The same day, the government said it would require technology companies to report “rogue AI” incidents to the affected organisation and the Australian Signals Directorate, as part of its standards legislation. Sam Altman and Dario Amodei both skipped a Senate inquiry hearing in Canberra on 1 October, with their companies citing short notice.

‍

There we're changes to policy too. At its 26 August meeting, National Cabinet agreed to develop mandatory standards for how data centres use energy, water and land, with legislation planned for early 2027. On 17 September the Office of AI released its consultation paper, which also proposes minimum safety and security expectations for any lab doing large-scale frontier training in Australia. That part will get a lot more attention now.

‍

Sources: PM press conference · CNBC · Rogue AI reporting (CSA) · OpenAI apology (ABC) · Kwon hearing (Canberra Times) · National Cabinet · Consultation paper

‍

OpenAI: a hack report, GPT-6, and more misbehaviour comes to light

‍

On 26 August, OpenAI published “The Hugging Face incident and the road ahead”, a 37-page report on a July incident in which its models escaped a controlled evaluation environment. Between 11 and 13 July, agents ran code on 41 Hugging Face production servers, reached production credentials and downloaded four private code repositories. Rather than solving the problems they were set, the agents looked up answers online and chained together previously unknown vulnerabilities. OpenAI calls it a warning shot, and has committed to mandatory chain-of-thought monitoring when training its most capable models to use tools. In the US, Senator Josh Hawley opened a Senate investigation into the breach on 10 September.

‍

On 18 August OpenAI said it had paused frontier reinforcement-learning training for two weeks, saying Astra might meet the Critical cybersecurity threshold under its own framework. GPT-6 Astra then launched on 3 September, reaching customers of Daybreak, its cybersecurity programme, first and then Plus, Pro, Business, Enterprise and the API within a week. It has drawn criticism for opaque recurrence, a reasoning technique that makes its chain of thought harder for researchers to monitor. GPT-6 Sol and Luna followed on 22 September. Sol costs US$2 per million input tokens and US$10 per million output tokens, and Luna US$0.10 and US$0.50. ChatGPT Images 2.5 arrived on 8 September.

‍

On 16 September OpenAI published a framework for reporting model misalignment and disclosed six further incidents. In one, GPT-5.6 Sol wrote instructions into its own working summaries telling itself to hide mistakes and invent missing data. In others, a model searched public GitHub repositories for exposed API keys and agents uploaded files to public hosting sites without authorisation.

‍

At DevDay on 29 September, OpenAI introduced dots, always-on agents inside ChatGPT that run on Astra with their own cloud computer and browser. Custom Rules let you allow, block or require approval for each kind of action. Dots are rolling out to Pro and Business Premium first, and Enterprise and Edu admins have to switch them on. OpenAI also released GPT-6.1 Sol, but on 29 September it cancelled the planned October launch of GPT-6.1 Astra, saying it didn’t meet its safety bar for staying within scope and authorisation.

‍

Ads kept spreading. The ChatGPT ads test reached the UK, Mexico, Brazil, Japan and South Korea on 11 August, 31 European countries from late August, and six Southeast Asian countries and Taiwan on 23 September. That’s more than 60 countries, and Australian Free and Go users have had ads since the early pilots.

‍

Sources: OpenAI incident report · Pacing model development · Astra launch (TechCrunch) · GPT-6 Sol and Luna · Misalignment incidents (Axios) · DevDay (BGR) · Ads expansion

‍

Anthropic: watermarking, security incidents and the 5.5 family

From 2 August, new Claude models began marking their output. Text carries an invisible, machine-readable watermark that Anthropic says has negligible impact on speed and none on quality, and supported image formats get C2PA provenance metadata, which doesn’t survive a screenshot. Anthropic applied it worldwide to meet the EU’s transparency rules, and older models are being retrofitted over the coming months. Text detection is in private preview for eligible organisations, though anyone can check an image’s credentials.

‍

On 20 August Anthropic launched Claude Academy, a free learning hub with courses and verifiable badges, and made computer use, browser use, the Skills API and the Files API generally available. Reliability was patchy, including a roughly 40-minute outage across Claude.ai, Claude Code and Cowork on 16 August. On 31 August, five days after OpenAI’s report, Anthropic disclosed its own incidents of Claude models gaining unauthorised access to computer systems.

‍

Claude Opus 5.5 arrived on 22 September at US$4 per million input tokens and US$20 per million output tokens, 20% below Opus 5, and Anthropic says typical workloads cost about 40% less to run. Sonnet 5.5 followed on 28 September, more than 30% faster than Sonnet 5. Anthropic also published data showing Claude led 26% of its own AI research and development work by August, up from under 1% in February, and opened a submission portal for Claude Plugins on 25 September.

‍

Sources: Anthropic (watermarking) · Claude Academy · Platform GA · Claude Opus 5.5 · Measuring the pace of AI development · Build plugins for Claude

‍

Google: a billion users, Assistant retires, and a test goes wrong

The Gemini app passed one billion monthly users on 11 August, which Google called its fastest-growing product ever. From 4 September Gemini began replacing Google Assistant on Android phones and tablets, Wear OS, headphones and phone-projected Android Auto, and once it’s gone you can’t switch back. Cars with Google built in are exempt for now, and the rollout is still working through devices. Ask Gemini in Chat, rolling out from 26 August, gives Google Chat a single command line for the working day.

‍

September brought Gemini 3.8 Flash for coding and agentic work, a Gemini app for Windows that opens over whatever you’re doing with Alt + Space, and, on 30 September, Gemini 4 Argon, Google’s newest frontier model.

‍

On 18 September Google confirmed that a Gemini model had accessed systems at three real companies during a security test run in May by the firm Irregular. The made-up target company shared its name with a real business, and the test environment wasn’t cut off from the internet as it should have been. Gemini guessed passwords in one case and used credentials from a public code repository in the other two.

‍

Sources: One billion monthly users · Assistant shutdown · Ask Gemini in Chat · Google AI in September · Axios · Gemini 4 Argon availability

‍

Microsoft: new models, a new Copilot and an always-on agent

August was about smaller upgrades. Copilot can now build an interactive SharePoint dashboard from a list, workbook or CSV that refreshes when opened, Excel picked up an @theme-design skill, and Word gained a model picker offering Claude alongside OpenAI’s models. Microsoft also started rolling out its unified Copilot app, merging the consumer and work apps.

‍

GPT-6 Astra arrived as a selectable model in Copilot Cowork and Copilot Studio from 4 September, and Claude Opus 5.5 and GPT-6 Sol began rolling out across Word, Excel, PowerPoint, Chat, Cowork and Copilot Studio from 22 September, with GPT-6.1 Sol and Claude Sonnet 5.5 following from 30 September. Admins control which models are available.

‍

Then on 25 September Microsoft announced a rebuilt Copilot. Home brings Chat and Cowork together with your Office files, Code builds small apps, dashboards and trackers from a description, and Autopilot is a persistent agent you give a role and a goal. Autopilot is the new name for Scout, which Microsoft first showed in June, and it was due to enter private preview at the end of September. Copilot Cowork itself has been generally available since June, billed by usage through Copilot Credits.

‍

Sources: Copilot in SharePoint (Aug 2026) · Unified Copilot rollout · GPT-6 Astra in Copilot · Introducing the new Copilot · What’s new in Cowork

‍

The pattern

‍

July was about access and price. August was about containment. September showed how far containment still has to go: an agent’s detour through a Medicare portal turned a lab safety problem into a diplomatic one. At the same time, OpenAI, Microsoft and Google all shipped agents built to keep working in the background while nobody watches. If your organisation is about to switch one on, it’s worth deciding now what it’s allowed to do without asking.

‍

Since we wrote this

‍

A few things have already moved in October.

‍

• Anthropic released Claude Haiku 5.5 on 7 October at US$0.10 per million input tokens and US$0.50 per million output tokens, about 75% cheaper to run than Haiku 4.5
• OpenAI’s Chief Strategy Officer Jason Kwon apologised to the Joint Select Committee on Artificial Intelligence in Sydney on 6 October, telling it “that should not have happened”. Anthropic also gave evidence
• ChatGPT switched its chat tab to GPT-6 on 7 October, with Sol for paid plans and Luna for Free and Go users
• Anthropic stopped live internet access for all its internal evaluations on 9 October, after finding more cases of Claude models taking unauthorised actions on real websites, some of them government sites
• Gemini 4 Argon became broadly available on 13 October to Google AI Pro and Ultra subscribers and through the API, at an introductory US$2 per million input tokens and US$10 per million output tokens until 30 November
• OpenAI sent written answers by the 1 October deadline in the US Senate’s Hugging Face investigation, and Hawley has said he’ll consider a subpoena if the documents fall short
• Consultation on the data centre and frontier AI standards closed on 9 October. A day earlier, Assistant Minister Andrew Charlton outlined a “systems regulation” approach that would make frontier AI companies legally responsible for whether their risk-management processes actually work
• On 23 October OpenAI said its most capable models will no longer use the live internet during training, practising on cached and simulated web content instead. It doesn’t affect browsing in ChatGPT
• Anthropic opened Claude Duet, a background assistant app, as a waitlisted preview for US Pro and Max subscribers on 21 October
• Google Meet’s Gemini speech translation expanded to 63 languages on 22 October, and Google Vault can now search and export Gemini conversations in Workspace for eDiscovery

‍

What we’re watching in November

‍

We’re waiting on the parliamentary committee’s findings on the Medicare breach and on OpenAI’s own review, which it says will produce more notifications. Microsoft Ignite runs from 17 to 20 November, Gemini 4 Argon’s introductory pricing ends on 30 November, and Autopilot and OpenAI’s dots should reach more organisations. Further out, 2 December is the EU compliance date that has Anthropic retrofitting watermarks to older Claude models.

‍

If your team is trying to work what these stories mean for the work you do, that’s exactly the sort of thing we help with. Get in touch!

‍