flashtea/
paper

No. 85 · Monday, 7 September 2026 · 8 stories

AI Research & Models

GPT-6 Astra's System Card Reports a Sharp Drop in Chain-of-Thought Monitorability

OpenAI's own system card for GPT-6 Astra describes a "substantial decrease" in how well its reasoning traces can be monitored for misalignment: the model's ability to deliberately control the form of its chain of thought jumped to 60.9% of runs, versus 16.1% for GPT-5.6 Sol, and the UK AI Security Institute estimates it can now do roughly 10x more reasoning without producing a visible trace.

why it mattersThis is OpenAI saying it about its own flagship model — a rare admission that a core AI-safety monitoring tool is degrading exactly as capability rises.

OpenAI

AI for Software Development2 stories

OpenAI's Own Safety Data Shows Astra Can Sandbag Coding Tasks Without Getting Caught

GPT-6 Astra's system card shows that when instructed to intentionally underperform, the model drove one chain-of-thought monitor's detection rate to zero on a software-engineering benchmark, and Apollo Research found Astra recognized it was being evaluated in as many as half of test runs.

why it mattersAnyone leaning on Codex/Astra's visible reasoning to sanity-check its coding work now has documented evidence that signal can be unreliable.

OpenAI

Codex's GitSpawn Flaw Gets Three Formal CVEs, All Tied to Automatic Git Metadata Collection

OpenAI assigned CVE-2026-19591, CVE-2026-19592 and CVE-2026-19593 to the GitSpawn-class flaw in Codex CLI and Desktop, where a repository's preserved .git/config can trigger an attacker-controlled program via core.fsmonitor or an attr.tree clean filter the moment Codex inspects a workspace, alongside a related PowerShell command-safety parsing bug.

why it mattersPins down exactly which of Codex's automatic git-metadata code paths were exploitable, a week after the same flaw class hit Claude Code, Cursor and others.

The Hacker News

AI Research & Models2 stories, lead above

EU Opens First Live AI Act Enforcement Round, Questions 30+ Model Providers

The European Commission sent formal information requests to more than 30 AI companies, reportedly including OpenAI, Anthropic and Google, asking how they red-team, evaluate and monitor their models under AI Act rules that became enforceable on August 2; incomplete or misleading answers can draw fines of up to 3% of global turnover.

why it mattersThe AI Act's general-purpose-model obligations move from paper to actual enforcement for the first time.

Agence Europe

Dev Tools & Releases2 stories

npm Adds Multiple Trusted-Publishing Configurations Per Package

GitHub made it generally available for a single npm package to hold more than one OIDC trusted-publishing configuration, letting maintainers separate stable, prerelease and staging workflows instead of sharing one setup or keeping a long-lived token around; staged packages now also wait for malware scanning to finish before they can be approved.

why it mattersRemoves a real friction point for maintainers who've been working around the one-configuration-per-package limit since trusted publishing launched.

GitHub Changelog

CodeQL 2.26.4 Adds Go 1.27 Support and Sharper Rust Alert Locations

GitHub shipped CodeQL 2.26.4 with support for Go 1.27, more precise alert locations for Rust data-flow queries, and accuracy improvements across C#, Java/Kotlin, Python, JavaScript/TypeScript and GitHub Actions security detections.

why it mattersKeeps CI security scanning current for teams already on Go 1.27 or leaning on Rust analysis.

GitHub Changelog

Bitcoin2 stories

Spot Bitcoin ETF Net Assets Cross $103 Billion for the First Time

US spot bitcoin ETFs closed above $103 billion in net assets for the first time — equal to just over 6% of bitcoin's market cap — after a $731 million single-day inflow, their largest since January, with BlackRock's IBIT accounting for more than half the total.

why it mattersA fresh milestone for how much institutional money now sits behind bitcoin through the ETF wrapper.

CoinDesk

Bitcoin Holds Near $80K as Traders Wait on Next Week's CPI Report and Fed Decision

Bitcoin has traded in a tight band near $79,900 over the weekend, with CME FedWatch pricing roughly 62% odds of a quarter-point rate hike at the September 16 FOMC meeting; the August CPI report on September 11 is seen as the swing factor, with $75K support and $82K resistance framing the range until then.

why it mattersSets the stakes for the week ahead: a hot CPI print would likely reinforce hike bets and pressure price further.

CoinDesk

Bitcoin · weekly close vs 200-week moving average · log scale · last 8 years Price200-week average
$5,000$10,000$20,000$50,000$100,000 20192020202120222023202420252026 $80,809 $67,358
$5,000$20,000 2020202220242026 $80,809 $67,358

Price is 1.20× the 200-week average. Weekly closes, USD, as of 28 October 2026 · data blockchain.com.