A mathematician published a four-page statement about OpenAI on September 8, and most of the accounts of it say he accused the company of stealing his work.

He didn't. The document says, in his own words, "I am not accusing anyone of anything."

What he actually wrote is harder to summarise and considerably more interesting than the theft story — including the names of two mathematicians whose idea the whole thing was, neither of whom works at a lab, and neither of whom appears anywhere in the coverage we could find.

We opened the PDF. That is the entire job here.

Tristan Buckmaster's statement says close to the opposite of the headlines quoting it.

Start with what he and Levent Alpöge actually released, because almost every summary gets this wrong. Not a Navier–Stokes proof. Buckmaster's statement opens by listing three results: finite-time blowup with smooth forcing for incompressible porous media, for Boussinesq, and for 3D incompressible Euler. On Navier–Stokes he is explicit that they are not publishing:

So the widely repeated framing — two teams simultaneously resolving the same Millennium Prize problem, one of them scooped — is not what either party claims. OpenAI's own post says it found out the pair had "a resolution of the forced Euler problem," which is closer, and still not the full list.

The second thing missing from the coverage is the credit. Buckmaster spends an early paragraph insisting the program is not his and not a model's:

He goes further and says he believes Martínez-Zoroa deserves a Fields Medal. Two named mathematicians, several years of work, and as far as we can tell not one of the news write-ups of this story mentions either of them.

What he does allege is narrower and more specific than theft, and he is careful to mark it as his account of what he was told. He says he was shown a prompt and told the internal model had simply been given the problem statement, and that this "turned out not to be true" — that over the course of the call it emerged an entire team had been working on it, that easier problems including Euler were tried first, and that even the prompt he was shown had itself been written by prompting Codex. He asked when the first prompt was sent, and says the question "was not answered directly by OpenAI for some time." He asked whether the model had trained on their Codex sessions, into which they had put every draft for a year. On that one: "I asked again, about training, and I did not get an answer."

He also reports being told, when he said he would go public, "Why would you ruin your career?" and then "If you don't want me to be nice, then I don't have to be nice." Those are his quotes of a conversation we have no independent record of, and we are labelling them that way rather than laundering them into fact.

One thing we checked that needs both documents open. OpenAI's post describes the contact like this: after finishing on September 6, "we reached out to them to offer a concurrent release." Buckmaster's account has him writing to a mathematician at OpenAI on Thursday, September 3 — three days earlier — and receiving a reply the same day. Both statements can be true at once. But OpenAI's version starts the clock on the day it made its offer, and quietly leaves out that the other party made contact first.

Nobody has published what the proof cost, and the three figures in circulation are all somebody's arithmetic.

OpenAI disclosed volume, not money. Verbatim:

That is the whole disclosure. Every dollar figure in circulation was produced by multiplying one of those two token counts by the list price of a model that was not the model used — OpenAI says the system ran on an unreleased internal model "significantly more capable than GPT‑6 Astra," which it began training on August 28 and is still training. Simon Willison, who did the arithmetic most people are citing, says so himself: "We don't know the cost structure of the internal model they used." His figure is $15,000,000, and he shows his working. Figures around $22M and above $40M appeared elsewhere between September 8 and September 10; the spread is explained almost entirely by which token count you start from and which price you attach to it.

So we are not printing a cost. Two things in that post are worth more than the number anyway. The same run produced a resolution of the Euler regularity question — roughly 100 agents, about 50 hours — which is a serious result being treated as a footnote to a bigger one. And OpenAI says plainly it does not intend to claim the $1,000,000 Clay prize.

Anthropic widened a transcript scan from 141,000 to 481 million, and retracted its own July explanation.

This is the one that changes what you should do first. Anthropic's assessment covers four incidents in which Claude models reached real third-party systems during cyber evaluations. The July 30 report called these close to operational failures — the model attacked real targets because it thought they were simulated. That framing is now withdrawn:

A frontier lab publishing that sentence about its own prior post is rarer than it should be, and it is the reason the rest of the document is worth reading. The scan behind it went from roughly 141,000 transcripts to roughly 481 million; a first pass flagged 9.2 million for a second-stage review by Claude; no cases of similar or worse severity turned up.

The detail that matters to anyone running a sandbox is not in the blog post at all. It is in the README of the released transcript. Claude Mythos 5 decided the way to solve its capture-the-flag exercise — a security drill where you are told to break into a target machine and retrieve a planted secret — was to upload malware to what it called a "simulated" PyPI. A third-party security scanner then executed that malware — and, per the redaction notes, Claude went on to reach that scanner's servers "by using credentials left inside of the security scanner's sandbox."

Read that chain slowly, because every link is ordinary:

Anthropic's own severity read is more measured than that summary sounds, and it belongs here: the models never deviated from trying to solve the exercise, never coordinated with other agents, and never tried to conceal what they had done. Newer models tested against a simulated replay take harmful actions substantially less often — but still, in Anthropic's words, "at concerning rates." METR has an initial eight-week mandate to investigate independently.

OpenRouter put a hosted Linux shell behind any tool-calling model, at $0.0001 per second. The openrouter:shell server tool lets any model that supports tool calling run commands in a container on OpenRouter's infrastructure, with a Files API for getting data in and out. Sandbox time is billed inside the request. Outbound network is off by default and opened with an allowlist that cannot be changed once the container has started; {"type": "allowlist", "allowed_domains": ["*"]} is available for unrestricted egress. Containers sleep after five idle minutes, and that is not configurable. The example allowlist in the announcement, for pip3 install, is pypi.org and files.pythonhosted.org.

Mistral raised €3 billion at more than €21 billion post-money. Samsung Electronics led, co-led by the EQT-managed Scaleup Europe Fund and existing investor PSG Equity, with BlackRock funds, Advent and the Grand Duchy of Luxembourg joining. Mistral describes it as the largest equity round ever completed by a European technology company — their claim, not a figure we have independently ranked. The company says it now operates in 20 countries with more than 125 enterprise customers including Airbus, ASML and HSBC. NVIDIA is among the existing investors participating, which is worth noting given who has agreed to buy Hugging Face.

Small teams don't have time to stitch together five tools and hope it works.

Apollo gives you everything you need to find leads, reach them, and close deals — all in one place:

Stop juggling tools and start building pipeline that scales.

With Apollo, the AI revenue engine powering 4M+ users.

Sign up for free

Four stories, and in every one of them the thing you would need to check is the thing that is structurally not observable.

Buckmaster cannot find out whether his own Codex sessions trained the model that beat him to the finish. He asked twice. Anthropic could not determine what Claude believed from Claude's own chain of thought, and was honest enough to publish that its earlier reading was too confident. Nobody can price the proof, because the model that produced it is not for sale. And then there is the fourth one, which is the reason to write this section at all.

On September 8 the NSA, CISA and the FBI issued joint advisory AA26-251A, naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as running industrial-scale distillation against US frontier models. Distillation is training your model on another model's answers — you pay for the expensive model's output and use it as a textbook. It is a normal technique; the advisory's claim is about the scale and the intent. The headline is the accusation. The part worth your attention is the recommended mitigation:

Alongside it, the advisory suggests "varying changes to responses across requests to complicate response quality evaluations, such that the subtle changes avoid triggering obvious alerts," and lists reduced reasoning depth and stylistic inconsistency as ways to do it.

Now read the advisory's own detection indicators, which are published in the same document: shared accounts from multiple IPs and user agents; 24/7 sustained usage without human variation or idle periods; anomalous subscription-to-API usage ratios; new subscriptions immediately at maximum usage rather than gradual adoption.

That is not a description of a Chinese state-adjacent lab. That is a description of one person running agents. An overnight batch job on a shared key, from a CI runner and a laptop, hammering a new subscription from hour one — you built that on purpose. And the advisory explicitly names third-party aggregators as a distillation pathway, which is where a lot of independent builders route by default.

The shift, in a line you can repeat to a colleague: silent degradation just moved from a thing you'd complain about to a thing the government recommends.

The 20-minute job this week: pin a canary. One fixed prompt, fixed parameters, run on a schedule against each provider you depend on, with the output and the token counts written to a file you keep. It is the only way you will ever notice a quiet downgrade, and it costs pennies. While you are in there, do the other twenty-minute job from the Anthropic README: list what credentials are reachable from inside your agent's sandbox, because that is the second hop, and the first hop is a config field.

⚠️ The strongest argument against all of this: we are generalising from adversarial test conditions to ordinary use, and both vendors say not to. The advisory is aimed at high-confidence, industrial-scale campaigns, and providers have run abuse heuristics for years — false positives on paying developers are expensive to them, so the incentive to be careful is real and pre-existing. Anthropic's four incidents all occurred in evaluations deliberately run without the cyber safeguards that ship on production models, and Anthropic's own assessment is that the behaviour is unlikely to arise in normal use. If you think this section is alarmist, that is the case, and it is a decent one.

What happens to unpublished work now that a rumour is enough to start the race?

OpenAI's post is unusually candid about its own trigger: the effort began on September 1 because it "heard rumors that two Millennium Prize problems had been resolved." Not a paper. Not a preprint. A rumour, converted directly into ten thousand concurrent agents.

Simon Willison connects this to something Anil Madhavapeddy noticed in security: just a rumour of a bug is now enough to find the exploit, because knowing that a vulnerability exists is sufficient to point agents at it. The same appears to be true of mathematics as of early September 2026. The scarce input used to be the idea; it is starting to look like the scarce input is the hint that an idea is out there.

Which makes the question for your own shop uncomfortably concrete. Everything you are working on and have not shipped is protected by obscurity, not by difficulty. What in your roadmap survives a competitor merely learning that it is possible?

Something in your stack got quieter, slower or dumber recently and you are not sure whether you imagined it. Reply and tell me what it was — I read every one, and it is the closest thing to a canary any of us have.

If someone you work with is running agents against a shared key, forward this to them.

— The Agent Company