The AI tooling companies hand their developers keeps failing its own containment, with researchers escaping OpenAI's Codex sandbox two separate ways and landing on the host machine.
Quiet day: only 45 security items in the last 48 hours.
Emerging Trends and Key Updates
- Trend Researchers escaped OpenAI's Codex sandbox twice while Ernst & Young found executives deploying autonomous systems faster than the controls meant to supervise them.
- Trend Automated systems increasingly decide who is watched and who is silenced, with Talking Tilly face-scanning every caller and Instagram wiping Albanian protest accounts through copyright complaints.
- Update · new Gyazo named the server vulnerability behind its breach, confirming hackers pulled 23.6 million user records out of the exposure it disclosed earlier this week.
- Trend Faith in the AI buildout is wobbling as Big Tech parks $300 billion off its balance sheets, Zitron dissects the borrowing, and Newport calls superintelligence a fairy tale.
- Update · new Ukraine's largest drone attack set a Moscow refinery ablaze as refining becomes the global supply choke point and a United States retailer began rationing motor oil.
- Update · new Locally, rain canceled the Renaissance Festival, canvassers are pressing Allegheny County's September 28 parental leave vote, and the Steelers face Drake Maye at New England.
Security
1. Researchers Escape the OpenAI Codex Sandbox
Latest developments: BleepingComputer reported on September 20, 2026 that researchers broke out of the sandbox around OpenAI's Codex coding agent two separate ways, one of them from the agent's most locked-down mode, and ran commands on the developer's own machine; OpenAI has patched both routes.
read more
Codex runs the code it writes inside a sandbox so that a hostile repository or a poisoned prompt stops at that boundary. Both escapes crossed onto the host, so anyone running Codex should take the patched release.
Sources: BleepingComputer · ↑ top
2. Talking Tilly Face-Scans Every Caller
Latest developments: BleepingComputer called the Talking Tilly video service on September 19, 2026 and found that it face-scans every caller to check for age 18 and over, then tracks the caller's mood through the conversation; the service shuts down permanently on September 27, 2026.
read more
Talking Tilly belongs to Tilly Norwood, the AI actress who went viral after glitching into Chinese on Piers Morgan Uncensored. A promotional gimmick now collects face scans and emotion readings from ordinary callers.
Sources: BleepingComputer · ↑ top
3. Gyazo Server Flaw Yields 23.6 Million Records
Latest developments: Gyazo confirmed on September 18, 2026 that hackers exploited a vulnerability in its server to pull out 23.6 million user records, naming the technical cause behind the exposure it disclosed earlier in the week.
read more
Gyazo, the image-sharing service that the Kyoto company Helpfeel runs, holds email addresses and password hashes in those records. Users should change their Gyazo password along with any password they reused elsewhere.
Sources: BleepingComputer · ↑ top
4. AI Deployment Outruns Its Controls
Latest developments: Ernst & Young published a survey of senior artificial intelligence executives on September 18, 2026 showing that their organizations deploy AI and autonomous systems faster than they build the processes and controls to oversee them.
read more
The gap leaves agents running with permissions nobody reviews and actions nobody logs. Tie every agent deployment to a named owner, a bounded permission scope, and an audit trail before it touches production.
Sources: Dark Reading · ↑ top
5. Meta Copyright Strikes Hit Albanian Protesters
Latest developments: Wired reported on September 18, 2026 that Instagram suspended accounts belonging to participants in Albania's Flamingo Revolution en masse through Meta's copyright reporting system, three months into daily protests against the Albanian government.
read more
Demonstrators and researchers read the wave of suspensions as brigading, with opponents filing copyright complaints that trigger automatic takedowns. Organizers who depend on Meta platforms should keep their accounts, contacts, and footage backed up somewhere else.
Sources: Wired Security · ↑ top
Business and Politics
Ukraine Sets a Moscow Refinery Ablaze in Its Largest Drone Attack
Latest developments: Ukrainian forces fired more than 1,000 drones at Russia overnight into Sunday, September 20, burning a major oil refinery in the capital as voting closed in Russia's parliamentary elections.
read more
Moscow's mayor called it the largest attack the capital has absorbed in the war. The strike pushes the fight deeper into Russia's refining base at a moment when diesel supply already sets the price of fuel worldwide, and it lands days after President Trump said Kyiv and Moscow had agreed to stop hitting each other's energy systems.
Refining Becomes the Choke Point, and a Retailer Rations Motor Oil
Latest developments: The Wall Street Journal reported Sunday, September 20, that refineries now form the main constraint on global energy supply, and the Financial Times reported the same morning that a United States retailer has begun rationing motor oil as prices quadrupled and supplies ran dry.
read more
The wars with Iran and in Ukraine have knocked out refining and lubricant capacity, leaving the world leaning on the Middle East and Russia for diesel and on a shrinking pool of base oil for vehicle engines. Crude prices now understate the squeeze, which reaches consumers through fuel, freight, and maintenance costs.
Sources: WSJ World News · FT Home · ↑ top
Guarantees Keep $300 Billion of AI Debt Off Big Tech Balance Sheets
Latest developments: The Financial Times reported Sunday morning, September 20, that the largest American technology companies have used guarantees to keep roughly $300 billion of artificial intelligence exposure off their balance sheets.
read more
Wall Street banks have turned the credit strength of the technology giants into cheaper funding for the data center buildout, financing construction through structures that never appear in the sponsors' reported debt. The arrangement leaves lenders and investors holding claims whose ultimate backing sits outside the disclosed leverage of the companies driving the boom.
Saudi Arabia Leaves China's Cross-Border Currency Platform
Latest developments: The Financial Times reported Sunday, September 20, that Saudi Arabia's central bank has withdrawn from the China-led cross-border currency platform.
read more
Beijing built the program as a piece of its effort to create an alternative to the dollar in international settlement, and the kingdom's participation gave it weight in energy trade. Riyadh's exit comes as Saudi Arabia leans on Washington for security after Houthi missile and drone attacks on its territory.
Pittsburgh
Weather
Today: Patchy Fog, high 78F.
Tonight: Patchy Fog, low 58F.
Monday: Chance Rain Showers, high 67F.
Business
Gas Plants That Could Double Pennsylvania's Power Capacity
Latest developments: The Post-Gazette reported Sunday, September 20, that natural gas power plants proposed around Pittsburgh would double Pennsylvania's generating capacity, and weighed how many of them will actually get built.
read more
Developers have lined up a slate of gas-fired projects across the region as data center demand pushes load forecasts higher. Financing, turbine supply, and grid interconnection stand between the announcements and any electricity, a gap that shapes what the buildout costs Pennsylvania ratepayers.
Sources: Pittsburgh Post-Gazette · ↑ top
The AI Horizons Summit Ends Between Hope and Despair
Latest developments: The Post-Gazette published its account of the AI Horizons Summit Sunday, September 20, describing technology leaders swinging between hope and despair over whether artificial intelligence will save or destroy people.
read more
The summit filled Bakery Square in Pittsburgh's East End this week, with Governor Josh Shapiro delivering the keynote and renewing his call for federal regulation, and U.S. Senator John Fetterman comparing the race to build the technology to the Manhattan Project. Speakers pointed to Western Pennsylvania's power supply and available land as the reason the industry keeps returning to the region.
Sources: Pittsburgh Post-Gazette · ↑ top
Around Town
Carnegie Mellon Moves to Limit Speech
Latest developments: The Post-Gazette reported Sunday, September 20, that Carnegie Mellon University has moved to restrict speech after controversial posts tested the limits of academic freedom on campus.
read more
Carnegie Mellon, in Pittsburgh's Oakland neighborhood, employs thousands of researchers whose public writing now falls under tighter university rules. The step puts one of the country's leading computer science and robotics institutions in the middle of the fight over what a university may tell its own scholars to say.
Sources: Pittsburgh Post-Gazette · ↑ top
Parental Leave Supporters Canvass Before a September 28 Vote
Latest developments: WTAE reported Saturday night, September 19, that supporters of Allegheny County's paid parental leave policy have started knocking on doors ahead of the Board of Health's decisive vote Monday, September 28.
read more
The board pared its proposal on Wednesday, September 16, cutting the benefit from 18 weeks to 12 and loosening eligibility after roughly 1,400 public comments, a county record. Union members, nurses, and parents rallied in Swissvale on Saturday, September 19, to press the board to keep the mandate intact.
Highlands Joins a National Animation Academy
Latest developments: TribLive reported Sunday, September 20, that Highlands High School is one of seven high schools in the country chosen for a first-time program exploring how to bring animation into the classroom.
read more
The academy gives Highlands students and teachers a role in shaping how animation gets taught in American public schools. The selection puts a small Allegheny Valley district alongside six others nationally in the program's inaugural year.
Events
Rain Cancels the Renaissance Festival and Moves a Hip-Hop Show
Latest developments: Organizers canceled the Pittsburgh Renaissance Festival for Sunday, September 20, and rescheduled the Slappers N Bangers hip-hop and R&B event, both announced Sunday morning as rounds of rain settled over the region.
read more
A stalled front has parked scattered showers and downpours over Western Pennsylvania, and WTAE flagged Sunday as an Impact Day for flooding risk. Ticket holders for either event should check the organizers' announcements for refund and makeup-date terms.
Sports
Pirates (78-77)
Sat Sep 19 · Royals 5 · Pirates 6 · Final
Up Next · Royals @ Pirates · Sun Sep 20, 1:35 PM
Steelers (1-0, T-1st in AFC North)
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
The Steelers Take Aim at Drake Maye
Latest developments: The Post-Gazette published its scouting report and Gerry Dulac his Week 2 picks Sunday morning, September 20, hours before the Steelers play at New England.
read more
The report frames the game around whether a Steelers defense built around T.J. Watt can pressure Patriots quarterback Drake Maye into turnovers, with Aaron Rodgers running Mike McCarthy's offense on the other side. Pittsburgh goes to Foxborough without receiver Michael Pittman Jr., out with a foot injury, and cornerback Joey Porter Jr.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Harmon Plays Through His Mother's Death
Latest developments: The Post-Gazette published a profile Saturday, September 19, of Steelers defensive lineman Derrick Harmon and how he is still learning to cope with his mother's death.
read more
Harmon lost his mother during his first year with the team and has leaned on captain Cam Heyward, who has guided younger linemen through the defensive front's rotation. The piece traces how grief has shaped his second season in Pittsburgh.
Sources: Post-Gazette Steelers · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To AI Debt (Part 1). Zitron opens a series dissecting the borrowing behind the artificial intelligence buildout, walking through how hyperscaler chief executives justify their GPU purchases to the finance chiefs who have to fund them. He argues the debt piling up against those data centers rests on revenue that has yet to appear.
- Stratechery — An Interview with Joanna Stern About the iPhone Duo and AI for Normal People. Ben Thompson interviews the Wall Street Journal's Joanna Stern about Apple's new iPhone Duo and how ordinary consumers actually use artificial intelligence. The conversation contrasts the industry's framing of AI capability with what shows up in everyday hands.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport answers Anthropic employees who said publicly that the systems they build could kill billions, calling superintelligence a story the industry tells itself. He argues the pursuit still does damage, through the resources it consumes and the policy it distorts.
Markets
S&P 500 7,609.16 ▼ -0.6% Dow 51,887.38 ▼ -1.4% Nasdaq 26,217.45 ▼ -0.4% WTI crude 101.53 ▲ +5.1% EUR/USD 1.1504 ▼ -1.0% GBP/USD 1.3448 ▼ -0.6% USD/JPY 155.04 ▲ +0.5%
Feed Health
Security: 24 of 24 feeds loaded, 45 items in the 48-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine.
Business and Politics: 8 of 8 feeds loaded, 59 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 13 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 23 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (247s of model time; $1.61 at API list price).