================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, September 20, 2026 - 8:04 AM EDT ================================================================ The AI tooling companies hand their developers keeps failing its own containment, with researchers escaping OpenAI's Codex sandbox two separate ways and landing on the host machine. Quiet day: only 45 security items in the last 48 hours. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Researchers escaped OpenAI's Codex sandbox twice while Ernst & Young found executives deploying autonomous systems faster than the controls meant to supervise them. see: Researchers Escape the OpenAI Codex Sandbox; AI Deployment Outruns Its Controls * [TREND] Automated systems increasingly decide who is watched and who is silenced, with Talking Tilly face-scanning every caller and Instagram wiping Albanian protest accounts through copyright complaints. see: Talking Tilly Face-Scans Every Caller; Meta Copyright Strikes Hit Albanian Protesters * [UPDATE (new)] Gyazo named the server vulnerability behind its breach, confirming hackers pulled 23.6 million user records out of the exposure it disclosed earlier this week. see: Gyazo Server Flaw Yields 23.6 Million Records * [TREND] Faith in the AI buildout is wobbling as Big Tech parks $300 billion off its balance sheets, Zitron dissects the borrowing, and Newport calls superintelligence a fairy tale. see: Guarantees Keep $300 Billion of AI Debt Off Big Tech Balance Sheets; Premium: The Hater's Guide To AI Debt (Part 1); Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. * [UPDATE (new)] Ukraine's largest drone attack set a Moscow refinery ablaze as refining becomes the global supply choke point and a United States retailer began rationing motor oil. see: Ukraine Sets a Moscow Refinery Ablaze in Its Largest Drone Attack; Refining Becomes the Choke Point, and a Retailer Rations Motor Oil * [UPDATE (new)] Locally, rain canceled the Renaissance Festival, canvassers are pressing Allegheny County's September 28 parental leave vote, and the Steelers face Drake Maye at New England. see: Rain Cancels the Renaissance Festival and Moves a Hip-Hop Show; Parental Leave Supporters Canvass Before a September 28 Vote; The Steelers Take Aim at Drake Maye SECURITY ---------------------------------------------------------------- 1. RESEARCHERS ESCAPE THE OPENAI CODEX SANDBOX AI Security · [ai, sandbox-escape, patch] Latest developments: BleepingComputer reported on September 20, 2026 that researchers broke out of the sandbox around OpenAI's Codex coding agent two separate ways, one of them from the agent's most locked-down mode, and ran commands on the developer's own machine; OpenAI has patched both routes. Codex runs the code it writes inside a sandbox so that a hostile repository or a poisoned prompt stops at that boundary. Both escapes crossed onto the host, so anyone running Codex should take the patched release. - BleepingComputer: https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/ 2. TALKING TILLY FACE-SCANS EVERY CALLER Data Privacy · [biometrics, privacy, ai] Latest developments: BleepingComputer called the Talking Tilly video service on September 19, 2026 and found that it face-scans every caller to check for age 18 and over, then tracks the caller's mood through the conversation; the service shuts down permanently on September 27, 2026. Talking Tilly belongs to Tilly Norwood, the AI actress who went viral after glitching into Chinese on Piers Morgan Uncensored. A promotional gimmick now collects face scans and emotion readings from ordinary callers. - BleepingComputer: https://www.bleepingcomputer.com/news/security/viral-ai-actress-hotline-face-scans-every-caller-watches-their-mood/ 3. GYAZO SERVER FLAW YIELDS 23.6 MILLION RECORDS Data Breaches · [breach, data-theft] Latest developments: Gyazo confirmed on September 18, 2026 that hackers exploited a vulnerability in its server to pull out 23.6 million user records, naming the technical cause behind the exposure it disclosed earlier in the week. Gyazo, the image-sharing service that the Kyoto company Helpfeel runs, holds email addresses and password hashes in those records. Users should change their Gyazo password along with any password they reused elsewhere. - BleepingComputer: https://www.bleepingcomputer.com/news/security/gyazo-server-flaw-exploited-to-steal-236-million-user-records/ 4. AI DEPLOYMENT OUTRUNS ITS CONTROLS AI Security · [ai, governance] Latest developments: Ernst & Young published a survey of senior artificial intelligence executives on September 18, 2026 showing that their organizations deploy AI and autonomous systems faster than they build the processes and controls to oversee them. The gap leaves agents running with permissions nobody reviews and actions nobody logs. Tie every agent deployment to a named owner, a bounded permission scope, and an audit trail before it touches production. - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/ey-survey-autonomous-ai-implementation-outpaces-oversight 5. META COPYRIGHT STRIKES HIT ALBANIAN PROTESTERS Policy and Regulation · [platform-abuse, censorship, policy] Latest developments: Wired reported on September 18, 2026 that Instagram suspended accounts belonging to participants in Albania's Flamingo Revolution en masse through Meta's copyright reporting system, three months into daily protests against the Albanian government. Demonstrators and researchers read the wave of suspensions as brigading, with opponents filing copyright complaints that trigger automatic takedowns. Organizers who depend on Meta platforms should keep their accounts, contacts, and footage backed up somewhere else. - Wired Security: https://www.wired.com/story/metas-copyright-system-is-being-weaponized-against-albanian-protesters/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Ukraine Sets a Moscow Refinery Ablaze in Its Largest Drone Attack Latest developments: Ukrainian forces fired more than 1,000 drones at Russia overnight into Sunday, September 20, burning a major oil refinery in the capital as voting closed in Russia's parliamentary elections. Moscow's mayor called it the largest attack the capital has absorbed in the war. The strike pushes the fight deeper into Russia's refining base at a moment when diesel supply already sets the price of fuel worldwide, and it lands days after President Trump said Kyiv and Moscow had agreed to stop hitting each other's energy systems. - FT Home: https://www.ft.com/content/2b6f1b4b-4010-4e95-8b5c-dfb2e32cd7ae?syn-25a6b1a6=1 * Refining Becomes the Choke Point, and a Retailer Rations Motor Oil Latest developments: The Wall Street Journal reported Sunday, September 20, that refineries now form the main constraint on global energy supply, and the Financial Times reported the same morning that a United States retailer has begun rationing motor oil as prices quadrupled and supplies ran dry. The wars with Iran and in Ukraine have knocked out refining and lubricant capacity, leaving the world leaning on the Middle East and Russia for diesel and on a shrinking pool of base oil for vehicle engines. Crude prices now understate the squeeze, which reaches consumers through fuel, freight, and maintenance costs. - WSJ World News: https://www.wsj.com/business/energy-oil/refineries-are-now-the-main-chokepoint-for-global-energy-supplies-f923e1ba?mod=rss_worldnews - FT Home: https://www.ft.com/content/64f90ab8-5fb0-4594-a900-d03e5ca051e3?syn-25a6b1a6=1 * Guarantees Keep $300 Billion of AI Debt Off Big Tech Balance Sheets Latest developments: The Financial Times reported Sunday morning, September 20, that the largest American technology companies have used guarantees to keep roughly $300 billion of artificial intelligence exposure off their balance sheets. Wall Street banks have turned the credit strength of the technology giants into cheaper funding for the data center buildout, financing construction through structures that never appear in the sponsors' reported debt. The arrangement leaves lenders and investors holding claims whose ultimate backing sits outside the disclosed leverage of the companies driving the boom. - FT Home: https://www.ft.com/content/7f11afae-c4e3-4054-a65b-873f3647f563?syn-25a6b1a6=1 * Saudi Arabia Leaves China's Cross-Border Currency Platform Latest developments: The Financial Times reported Sunday, September 20, that Saudi Arabia's central bank has withdrawn from the China-led cross-border currency platform. Beijing built the program as a piece of its effort to create an alternative to the dollar in international settlement, and the kingdom's participation gave it weight in energy trade. Riyadh's exit comes as Saudi Arabia leans on Washington for security after Houthi missile and drone attacks on its territory. - FT Home: https://www.ft.com/content/ac104987-f43d-4e7d-97b6-057d98f7e422?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Patchy Fog, high 78F. Tonight: Patchy Fog, low 58F. Monday: Chance Rain Showers, high 67F. Business: * Gas Plants That Could Double Pennsylvania's Power Capacity Latest developments: The Post-Gazette reported Sunday, September 20, that natural gas power plants proposed around Pittsburgh would double Pennsylvania's generating capacity, and weighed how many of them will actually get built. Developers have lined up a slate of gas-fired projects across the region as data center demand pushes load forecasts higher. Financing, turbine supply, and grid interconnection stand between the announcements and any electricity, a gap that shapes what the buildout costs Pennsylvania ratepayers. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/09/20/natural-gas-power-plants-pittsburgh/stories/202609200058 * The AI Horizons Summit Ends Between Hope and Despair Latest developments: The Post-Gazette published its account of the AI Horizons Summit Sunday, September 20, describing technology leaders swinging between hope and despair over whether artificial intelligence will save or destroy people. The summit filled Bakery Square in Pittsburgh's East End this week, with Governor Josh Shapiro delivering the keynote and renewing his call for federal regulation, and U.S. Senator John Fetterman comparing the race to build the technology to the Manhattan Project. Speakers pointed to Western Pennsylvania's power supply and available land as the reason the industry keeps returning to the region. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/tech-news/2026/09/20/ai-horizons-summit-pittsburgh-shapiro/stories/202609200061 Around town: * Carnegie Mellon Moves to Limit Speech Latest developments: The Post-Gazette reported Sunday, September 20, that Carnegie Mellon University has moved to restrict speech after controversial posts tested the limits of academic freedom on campus. Carnegie Mellon, in Pittsburgh's Oakland neighborhood, employs thousands of researchers whose public writing now falls under tighter university rules. The step puts one of the country's leading computer science and robotics institutions in the middle of the fight over what a university may tell its own scholars to say. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/09/20/carnegie-mellon-free-speech/stories/202609180065 * Parental Leave Supporters Canvass Before a September 28 Vote Latest developments: WTAE reported Saturday night, September 19, that supporters of Allegheny County's paid parental leave policy have started knocking on doors ahead of the Board of Health's decisive vote Monday, September 28. The board pared its proposal on Wednesday, September 16, cutting the benefit from 18 weeks to 12 and loosening eligibility after roughly 1,400 public comments, a county record. Union members, nurses, and parents rallied in Swissvale on Saturday, September 19, to press the board to keep the mandate intact. - WTAE: https://www.wtae.com/article/allegheny-county-residents-canvass-for-paid-parental-leave-ahead-of-key-vote/73805780 * Highlands Joins a National Animation Academy Latest developments: TribLive reported Sunday, September 20, that Highlands High School is one of seven high schools in the country chosen for a first-time program exploring how to bring animation into the classroom. The academy gives Highlands students and teachers a role in shaping how animation gets taught in American public schools. The selection puts a small Allegheny Valley district alongside six others nationally in the program's inaugural year. - TribLive: https://triblive.com/local/valley-news-dispatch/highlands-among-7-schools-in-u-s-chosen-to-participate-in-animation-academy/ Events: * Rain Cancels the Renaissance Festival and Moves a Hip-Hop Show Latest developments: Organizers canceled the Pittsburgh Renaissance Festival for Sunday, September 20, and rescheduled the Slappers N Bangers hip-hop and R&B event, both announced Sunday morning as rounds of rain settled over the region. A stalled front has parked scattered showers and downpours over Western Pennsylvania, and WTAE flagged Sunday as an Impact Day for flooding risk. Ticket holders for either event should check the organizers' announcements for refund and makeup-date terms. - WPXI: https://www.wpxi.com/news/local/pittsburgh-renaissance-fair-canceled-sunday/DMCJIXYR6JAD7AKWHCQQPISMGM/ - WPXI: https://www.wpxi.com/news/local/slappers-n-bangers-rescheduled-because-expected-rain/CJNIQSIQ2NBCNLWI3TILO3LGOU/ SPORTS ---------------------------------------------------------------- Pirates (78-77) Sat Sep 19 · Royals 5 · Pirates 6 · Final https://plaintextsports.com/mlb/2026-09-19/kc-pit Up Next · Royals @ Pirates · Sun Sep 20, 1:35 PM https://plaintextsports.com/mlb/2026-09-20/kc-pit Steelers (1-0, T-1st in AFC North) Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM https://plaintextsports.com/nfl/2026/week2/pit-ne Around the Teams: * The Steelers Take Aim at Drake Maye Latest developments: The Post-Gazette published its scouting report and Gerry Dulac his Week 2 picks Sunday morning, September 20, hours before the Steelers play at New England. The report frames the game around whether a Steelers defense built around T.J. Watt can pressure Patriots quarterback Drake Maye into turnovers, with Aaron Rodgers running Mike McCarthy's offense on the other side. Pittsburgh goes to Foxborough without receiver Michael Pittman Jr., out with a foot injury, and cornerback Joey Porter Jr. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/20/drake-maye-tj-watt-aaron-rodgers/stories/202609170079 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/20/week2-nfl-picks/stories/202609180051 * Harmon Plays Through His Mother's Death Latest developments: The Post-Gazette published a profile Saturday, September 19, of Steelers defensive lineman Derrick Harmon and how he is still learning to cope with his mother's death. Harmon lost his mother during his first year with the team and has leaned on captain Cam Heyward, who has guided younger linemen through the defensive front's rotation. The piece traces how grief has shaped his second season in Pittsburgh. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/19/derrick-harmon-mom-cam-heyward/stories/202609180012 READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To AI Debt (Part 1) Zitron opens a series dissecting the borrowing behind the artificial intelligence buildout, walking through how hyperscaler chief executives justify their GPU purchases to the finance chiefs who have to fund them. He argues the debt piling up against those data centers rests on revenue that has yet to appear. https://www.wheresyoured.at/premium-the-haters-guide-to-ai-debt-part-1/ * Stratechery -- An Interview with Joanna Stern About the iPhone Duo and AI for Normal People Ben Thompson interviews the Wall Street Journal's Joanna Stern about Apple's new iPhone Duo and how ordinary consumers actually use artificial intelligence. The conversation contrasts the industry's framing of AI capability with what shows up in everyday hands. https://stratechery.com/2026/an-interview-with-joanna-stern-about-the-iphone-duo-and-ai-for-normal-people/ * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport answers Anthropic employees who said publicly that the systems they build could kill billions, calling superintelligence a story the industry tells itself. He argues the pursuit still does damage, through the resources it consumes and the policy it distorts. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,609.16 ▼ -0.6% Dow 51,887.38 ▼ -1.4% Nasdaq 26,217.45 ▼ -0.4% WTI crude 101.53 ▲ +5.1% EUR/USD 1.1504 ▼ -1.0% GBP/USD 1.3448 ▼ -0.6% USD/JPY 155.04 ▲ +0.5% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 45 items in the 48-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine. Business and Politics: 8 of 8 feeds loaded, 59 items in the 36-hour window. Events: 4 of 4 feeds loaded, 13 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 23 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (247s of model time; $1.61 at API list price). ================================================================ Generated 2026-09-20 08:04 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================