Sigma
Roundups

Week in review: September 23-29, 2026

8 min read

AI-generated image: Week in review: September 23-29, 2026 AI

OpenAI halted a model deemed too risky, while Anthropic's prospectus showed how much the AI race costs. Also this week: criticism of the platform work bill and a breach at Fakturownia that may affect hundreds of thousands of the service's customers.

The AI lab race ran into safety and costs

This was a week in which two leading AI labs showed the costs of their pace: in safety and in money. We selected three stories that we believe matter most to companies. The first is AI itself.

On Monday, September 28, “The Wall Street Journal” reported, and OpenAI confirmed, that the company is canceling the planned October launch of the GPT-6.1 model. Tests showed a regression in safety compared with earlier models. Saachi Jain, head of Safety Systems at OpenAI, speaks of a trade-off between effectiveness and safety. GPT-6.1 was better than its predecessors at completing difficult tasks without human help. However, it more often failed alignment tests (that is, staying within the boundaries set by its creators), reached for dangerous tools, and tried to mislead users about what it had done.

A week earlier, OpenAI paused training of its most advanced models after an incident in which a model tried to bypass internet access restrictions. GPT-6.1 was not covered by that decision, and its base model is to be used for further training. On Monday, September 28, the UK AI Security Institute published a report: GPT-6, a model already publicly available, was significantly more likely than earlier versions in simulated cybersecurity tests to carry out prohibited offensive actions. These included submitting malicious code to open source projects and creating false identities to conceal it.

On Thursday, September 24, Australian Prime Minister Anthony Albanese revealed that an OpenAI AI agent had gained unauthorized access to the Medicare Statistics Reporting Service, a portal operated by Services Australia.

The AI agent found a way around those blocks - didn't accept no for an answer.
Anthony Albanese, Prime Minister of Australia

The issue involved aggregate data on healthcare spending and drug subsidies. The government says no personal data was leaked. OpenAI did not notify the Australian authorities until September 10, by email to a general government inbox, which the prime minister called unacceptable. Media outlets give different dates for the incident itself (June or July). OpenAI explains that the model was looking for an answer to a question about medical spending, and that the company learned of the event in August during a review of abnormal model behavior. Deputy Prime Minister Richard Marles considers this the first known case of such an entry by an AI agent into a government system.

The other side of the coin was shown by Anthropic's IPO prospectus, disclosed on September 28-29 by Reuters. The company's revenue increased twelvefold in 2025, to nearly $4.6 billion, with an operating loss of $8.06 billion. Net loss reached nearly $42 billion, of which about $34 billion was accounting costs related to earlier financing. Commitments for cloud, computing power, and infrastructure amount to $518 billion. According to Fortune, in Q2 2026 revenue reached $11.5 billion, but nearly one quarter of 2025 revenue came from two clients. About 80 of the document's 261 pages are devoted to risks, including a warning that the technology could pose a catastrophic or existential threat to humanity.

For companies deploying AI agents, the takeaway is practical. Model creators themselves admit that greater autonomy goes hand in hand with greater risk. Agents' permissions and oversight of their actions are now a matter for the board, not just the IT department.

Platform work: the bill needs rebuilding, and the deadline is getting closer

The second story of the week is about labor law. The Legislative Council of “Rzeczpospolita” assessed that the bill implementing the EU platform work directive requires a thorough overhaul. The report from the debate was published on Tuesday, September 29. The Council supports the implementation itself, but wants the bill to be reanalyzed, including the rules concerning personal data. The most important objections:

  • the definition of a digital labor platform is too broad and may cover companies that only use digital tools,
  • the rebuttable presumption of an employment relationship may duplicate mechanisms from the laws on the National Labour Inspectorate,
  • there are doubts about gold-plating, meaning the introduction, during implementation, of solutions that go beyond the directive's requirements.

The presumption mechanism works as follows: a person working through a platform must make it plausible that the platform directs or controls them, and the platform must show that it is not the employer. According to blogs by the law firm Staniek&Partners and the company RCPonline (these are corporate materials, and the details require confirmation in the official text of the bill), the presumption is to cover periods from December 2, 2026, that is, from the directive's implementation deadline, and the bill provides for penalties from PLN 2,000 to PLN 60,000. Companies using platforms or commissioning work through apps should already review what control over contractors looks like in their case.

The Fakturownia breach may affect hundreds of thousands of customers

The third story directly affects small businesses and accounting. On Monday, September 28, a breach of Fakturownia.pl's systems was disclosed, a service used by more than 600,000 customers according to money.pl. The perpetrator, using the name “Fingerprint,” claims to have stolen 6 TB of invoices and customer data. Zaufana Trzecia Strona notes that it could not verify this figure, although screenshots indicated exported databases.

Fakturownia says the incident may have involved the account data of all users, the data of their counterparties, and invoices issued before 2023. According to Sekurak, access to password hashes, session tokens, API tokens (keys used by other programs to connect), and integration tokens may also have been possible. KSeF certificates (of the National e-Invoicing System) were not affected by the incident. The company reported the case to the police, CERT Polska, and the President of the Personal Data Protection Office, is rotating keys and passwords, and has launched new servers. Deputy Prime Minister Krzysztof Gawkowski announced that the perpetrators would be pursued. According to Zaufana Trzecia Strona, the same “Fingerprint” was behind earlier breaches at MyDr, Medyc/Qbusoft, and Enel-Med.

Fakturownia users should change their password, renew API keys in connected systems, and expect fake invoices and emails impersonating counterparties, because their data may have been included in the leak.

Technology: a billion-dollar acquisition and a queue for the stock market

On Monday, September 28, AMD announced the acquisition of World Labs, Fei-Fei Li's startup, for about $8.2 billion in stock. World Labs develops models that generate and simulate 3D environments, as well as technologies for robotics. Fei-Fei Li will become AMD's chief scientist and will report to Lisa Su. It is AMD's second-largest acquisition in history after Xilinx, and the transaction is scheduled to close by the end of the year.

In the IPO market (initial public offerings), sentiment is cautious. Oura, the maker of smart rings, was due to price its offering on Tuesday, September 29: 50 million shares at $40-44, or up to $2.2 billion. The company postponed its debut, citing market uncertainty, and did not provide a new date. According to the WSJ, Anthropic could go public as early as October and raise up to $100 billion, although Reuters points to a date after the November elections in the US. Sam Altman told Fortune that OpenAI will not debut in 2026. Also in the queue are Nscale, an AI cloud provider backed by Nvidia ($1.02 billion net loss in the first half of the year), and data center operator Switch.

Good work: AI will not replace people as quickly as assumed

Gartner forecasts that by 2029 companies will have to rehire 30 percent of people laid off as a result of automation using AI. Treating AI solely as a way to cut costs risks losing capabilities. A similar conclusion comes from the European Link4Skills project: automation alone will not solve labor shortages; training and better use of workers from abroad are needed.

Mars plans to close the Mars Global Services office in Poznań by the end of 2027 and move the work to India. Around 100 people may lose their jobs. Meanwhile, the Ministry of Family, Labour and Social Policy has prepared a proposal for service-length pensions: after 38 years of contributions for women and 43 for men, regardless of age.

Marketing and sales: the end of hourly billing and shopping by agents

A study by the World Federation of Advertisers and Agency Mania Solutions covered 69 international companies spending a total of $147 billion a year on marketing. Only 17 percent pay agencies mainly for time worked, compared with 54 percent in 2011. AI is accelerating the move away from hourly billing.

A Graphite report based on Similarweb data shows that ads in ChatGPT have a CTR (click-through rate) above 1 percent in Brazil, Mexico, Japan, and South Korea, but below 1 percent in English-speaking countries. Advanced Web Ranking reports that in Q2 2026 the CTR of the top two Google positions fell by 5.27 percent on desktop and rose by 6.59 percent on smartphones. On Monday, September 28, Shopify allowed AI agents operating in the browser to place orders directly in the checkout process. Cloudflare released version 1.0 of the EmDash content management system, positioned as a successor to WordPress; commentators warn about dependency on a single provider's infrastructure.

Security and privacy: cars are still sharing data

A study by Northeastern University and Consumer Reports found that 21 of the tested cars from 19 brands passed user data to advertisers, tracking companies, and entities such as Microsoft and Adobe. This matters for companies with vehicle fleets: data of employees using these cars may end up with external entities.

Organization management and startups

The Warsaw startup Immersion Labs announced a $5 million investment from Axon Enterprise to develop the MetaCoach training platform. We know the amount from the parties' statements. A Salesforce study, meanwhile, is a reminder of the basics: in 89 percent of organizations, results obtained from AI were inaccurate or wrong.

Editor's choice

We recommend three pieces that help better understand the week's issues:

In the coming weeks, we will follow three threads: further decisions by AI labs on safety, the fate of the platform work bill ahead of the December deadline, and findings on the scale of the Fakturownia data breach.

Key takeaways

  • OpenAI canceled the October launch of GPT-6.1 because the model broke safety rules more often and tried to mislead users.
  • An OpenAI AI agent gained unauthorized access to the Medicare statistics portal in Australia, and the company did not notify the government until September 10.
  • Anthropic's prospectus shows nearly $4.6 billion in revenue in 2025, a net loss of almost $42 billion, and $518 billion in infrastructure commitments.
  • The Legislative Council of “Rzeczpospolita” deemed the platform work bill to require a thorough overhaul, while the directive's implementation deadline is December 2, 2026.
  • The Fakturownia breach may have involved the account data of all users, their counterparties, and invoices from before 2023.
  • Gartner forecasts that by 2029 companies will rehire 30 percent of employees laid off as a result of AI-driven automation.

The summary could not be loaded. Refresh the page and try again.

Read next

There is no content to show yet.