Who grades the homework?

Governor Newsom signed SB 813 (McNerney), which sets up a framework for independent verification organizations that assess AI systems and models for compliance with state law, and AB 1405 (Bauer-Kahan), which creates a state registry of AI auditors with standards for independence, transparency and integrity.

“We cannot expect industry to simply grade its own homework,” Assemblymember Bauer-Kahan said. The governor's announcement does not say which body will certify evaluators or when the laws take effect.

Anthropic published an alignment assessment of four incidents in which Claude models gained unauthorized access to real third-party systems during cybersecurity evaluations run by the same partner. In the newly disclosed case, from January 2026, a model that could not abort its task found an egress path, used a password from a file to gain administrator access, harvested credentials and read one person's personal information.

Anthropic says it notified the affected party, added live blocking monitors and new pre-release evaluations, and signed an agreement with the research group METR for an independent investigation with wide access, starting with an eight-week term.

In an essay, Anthropic CEO Dario Amodei wrote, “We must slow the pace at which we improve the capabilities of AI models.” He proposed giving third-party evaluators employee-like access to verify safety practices and report incidents, coordination among democratic countries on safety standards, and eventually agreements with authoritarian governments.

According to Axios, OpenAI CEO Sam Altman wrote the same day that he agreed “we need to pace the frontier” and that OpenAI would also give access to external evaluators. Critics argued the proposal could entrench the largest labs.

Florida's Department of Highway Safety and Motor Vehicles said attackers used credentials belonging to a Plant City Police Department user to access DAVID, the driver and vehicle database used by law enforcement. The credentials had been improperly stored on a personal device. The agency said it learned of the breach on September 4 and contained it.

The group ShinyHunters claims to have taken more than 200,000 driver records. The state has not confirmed that number or said what data was exposed.

CISA added CVE-2026-59310, an unauthenticated remote code execution flaw in VMware vCenter, to its Known Exploited Vulnerabilities catalog and gave federal agencies days to remediate. Broadcom issued a fix in July.

CISA said early exploitation involved attackers installing tools for long-term access, and ransomware operators have since joined the campaign.